action-based authorization for node.js and browser applications