basic authorisation framework
fix scaffolded trip right stuff
enforce a set of permissions
fix json area builder