Added basic authorization. Permission class responsible for authorization. Application controller enforces it accross all the controllers. specs updated to login using support helper.