rule based access-controls engine for node.js (browser compatible)