* apos.get now checks permissions as part of the query, rather than performing a very expensive fetch of all pages followed by separate permissions calls.
* The new permissions scheme is similar to A1.5 permissions. If the req.user.permissions array contains 'admin' that user can fetch everything. Otherwise, if they have a req.user.groupIds property, that array is checked against the viewGroupIds and editGroupIds of pages. All users can see pages that do not have the loginRequired property. The 'published' criterion is checked for, as always, and enforced for non-admins who do not have edit privileges by way of editGroupIds.
* Actual group memberships are still coming.