sometimes model.session.userId is available, sometimes
model.get('_userId'). *sigh*
move party suscriptions to separate function so we can re-activate
when party change
only show party in menu if unlocked
better party-unlocked message
remove all the debugger statements
fixing up permission system for API tokens & server-requests
proper accessControl testing of server routes, fix REST