Verify requests for user information

[dpopp07]

Right now, a token assigned by Auth0 will allow access to any route and therefore any data in the database that can be retrieved by the API. A user, with their own token, should only be able to access user data for themselves, but not for any other users. This could be tricky but it worth looking into.