first skelton of route_posts
rename to authorization_manager
skelton of route_users
skelton of route_groups
to hasPermission
sub middleware
simplified permission but scope for groups/users
passport-local for testing