Moved the api routes into their own folder, extended the login functionality to retrieve the permissions that a user has and added a requirePermission middleware.