app password: add tests for the rest routes

src/routes/apppasswords.js

@@ -34,7 +34,7 @@ function add(req, res, next) {
     users.addAppPassword(req.user.id, req.body.identifier, req.body.name, function (error, result) {
         if (error) return next(BoxError.toHttpError(error));
 
-        next(new HttpSuccess(200, result));
+        next(new HttpSuccess(201, result));
     });
 }
 
@@ -44,7 +44,7 @@ function list(req, res, next) {
     users.getAppPasswords(req.user.id, function (error, result) {
         if (error) return next(BoxError.toHttpError(error));
 
-        next(new HttpSuccess(200, result));
+        next(new HttpSuccess(200, { appPasswords: result }));
     });
 }
 
@@ -52,6 +52,7 @@ function del(req, res, next) {
     assert.strictEqual(typeof req.user, 'object');
     assert.strictEqual(typeof req.params.id, 'string');
 
+    // TODO: verify userId owns the id ?
     users.delAppPassword(req.params.id, function (error) {
         if (error) return next(BoxError.toHttpError(error));