move API protection check into hooks, adjusting corresponding tests

src/routes/api/users/+server.ts

@@ -5,9 +5,6 @@ import bcrypt from 'bcrypt';
 const saltRounds = 12;
 
 export function GET({ locals }) {
-	if (!locals.user) {
-		return json({ error: 'Unauthorized' }, { status: 401 });
-	}
 
 	const userList = getUsers();
 
@@ -15,10 +12,6 @@ export function GET({ locals }) {
 }
 
 export async function POST({ request, locals }) {
-	if (!locals.user) {
-		return json({ error: 'Unauthorized' }, { status: 401 });
-	}
-
 	const data = await request.json();
 	const userName = data.userName;
 	const userPassword = data.userPassword;