All endpoints except /login and / should check for Authorization header

[gsf]

User token will be passed in Authorization header for requests. Some endpoints, like /search, will return a response suited to the user's permission level for requests with a passing Authorization header, a 401 for a failing Authorization, and a publicly accessible response for requests without the header.

[gsf]

We'll probably need to do this on the item-get, -set, and -delete routes as a requirement for #73.