Implement user permissions and authorize

Addresses #34.