Why

This PR addresses the following problem / context:

• every endpoint should be covered with an auth dependency

How

Implementation summary - the following was changed / added / removed:

• added user: <auth dependency> to every endpoint

Notes

Any special considerations, workarounds, or follow-up work to note?

• Some routers had auth dependencies injected at the router, not each endpoint. I changed it to be endpoint-specific so that the user object can be utilized. This will allow us in the future to return objects, like things or locations, and hide some fields (e.g. notes), from unauthenticated users. To do this we'll need to set the viewer dependencies to optional=True. But that's an issue for our future selves.
  • This doesn't really adhere to DRY, but if we want to hide specific fields or records from GET endpoints I think that the auth dependency should be injected at the endpoint, not the router.
• All of the data currently being modeled is from AMP. I'm not sure when to use amp auth dependencies or general dependencies. This is most pertinent to the /thing, /sample, and /observation routers. Should they be general auth dependencies for now? Does it matter for the time being since everyone using the app is AMP?