Missing `jwt_required` on route `favorites`

[adam-cowley]

Thanks for the heads up, I'll push a fix for this in the next couple of days