Fix most glaring bugs and vulnerabilities

express/routes/api/v1/portals.js

@@ -1,4 +1,5 @@
 const router = require('express-promise-router')()
+const user = require('../../../middleware/user')
 
 const {
   create,
@@ -10,6 +11,9 @@ const {
   deleteLinkedDictionary
 } = require('../../../controllers/api/v1/portals')
 
+// All further routes are only available to portal admin.
+router.use(user.isAuthenticated, user.isPortalAdmin)
+
 // Create new portal connection
 router.post('/createPortal', create)