wrote @authorized_json decorator

returns 403 if current user doesn't have permissions to request a
URL. This should be used on URLs that return json