implements transaction CRUD, enforcing authorization rules at middleware...

... and service layer.  Note also that the manner in which parameters were being read from the request object in 'authentication.js' had to be extended to accomodate various routes and verbs from:
-  var id = request.body.id;
 -  var token = request.body.session_token;
to 
+  var id = request.params.userId || request.query.userId || request.body.userId;
 +  var token = request.params.session_token || request.query.session_token || request.body.session_token;