fix(sec): protect transition route

Fix a security issue that allowed anybody to apply a transition to any profile.

• require user to be logged to apply a transition
• only profile own and admin can apply a transition

Fix #135 Ref !80