Assorted small fixes

[bazacko]

-review status codes
-menuID (already made issue)
-pic POST - do we need a period in Key
-pic POST - are we checking for no-menu-found (returns null?)
-auth-route-test - use mock-user
-auth-route-test - on signin, check token format
-biz-route-test - use mock-user
-biz-route-test - check User.findbyidandremove
-biz-route-test - write full route in describe() for clarity
-biz-route-test - testing DELETE for valid body/invalid request - use other (invalid) token