Authorization (NOT authentication) plugin for mongoose