centralizing userrights

to a middleware, so it can be checked there independently from UI