refactoring
added auth package
added models needed for permission handling
added principal code for permission handling