added username authentication to server
added permission checking to all server routes where it is needed