fix: only use JWT middleware on /api paths

[rolznz]

Fixes #1071 by only applying the JWT config to the /api prefix.

I do not understand why this works, as this should mean the non-restricted API endpoints would not work, but they still do. This needs to be understood properly before merging.

Also moves a few endpoints into the restricted group (they were still protected, but it's better for them to be protected by the JWT middleware)

restrictedApiGroup := e.Group("/api")
restrictedApiGroup.Use(echojwt.WithConfig(jwtConfig))

[im-adithya]

LGTM

[rolznz]

As far as I can tell this is due to buggy handling of groups when the path is set to "", combined with how the static middleware handles not found routes

[rolznz]

Further debugging thanks to @im-adithya

Before we had the group prefix as "" and it has a not found handler which applies its middleware, which includes the JWT middleware. See https://github.com/labstack/echo/blob/master/group.go#L116-L118

The static middleware also tries to apply other middleware before falling back to the index page: https://github.com/labstack/echo/blob/master/middleware/static.go#L188-L209

That's why all routes except the index are default 404s and therefore hit the JWT middleware from the restricted group.

Now that we moved the group to /api and all our api routes are clearly defined, the 404 route is not hit for our non-restricted api endpoints, but an unknown API route will hit the JWT middleware because of the restricted group's fallback not found handler.