Raise API test coverage

Please remind me if I need any endpoint / scenario on this list. I know i do, but will not take the time to write the checklist thoroughly just yet.

[x] Access to other people's projects and observations is not allowed
[x] Patch observation with isDraft:true is not allowed
[ ] View projects and observations without token == 401
[ ] Patch/post resources without token == 401
[X] Change project settings
[ ] Change project settings where not allowed
[x] Email validation on signup
[x] Password validation on signup
[x] Basic login error messages
[x] Invitees have project access
[x] Create observation on project as owner
[ ] Create observation on project as invited
[x] Invitation flow (possibly wait until after invitation link feature is built)
[ ] Image upload endpoint and overwriting work
[ ] Discard an observation
[x] User can delete himself
[x] Projects are not deleted when you delete your user (unless no other users are associated with the project)
[x] Delete user without token == 401
[ ] File upload endpoint (incl. mimetype/filesize/multiple error scenarios)
[ ] Delete project parameter
[ ] Add project parameter
[x] You cannot modify other people's observations
[x] Invited users cannot see other people's observations
[x] Create dynamic fields (time difference & numeric sum)
[x] Test that errors are returned if you create a dynamic field (diff string & date)
[ ] That invited collaborators cannot see/edit project collaborators, fields & dynamic fields

nikobojs / manuscrape_electron