Sensitive routes not protected

- fetching all user details and update user route not protected
- Expected :- not all users should have access to update others details and un-authorised users should not be able to fetch all all users data

Start by locating the routes that fetch all user details and update user details, then read how authentication and authorization are currently handled there. Done means unauthorized requests cannot fetch all users and an authenticated user cannot update another user's details; verify both behaviors with the repository's existing test or request workflow if available.

Written by the indexing model from the issue text.