audit all routes for auth and isOwner

[pastudan]

  if (!(await middlewareAuth(req, res))) {
    return;
  }

  if (!req.isOwner) {
    return res.status(400).json({ error: "Only the owner can reset setup" });
  }