check for authorization on powerful routes
clean up user ctrl
extensible auth levels and user schema constraints