http commands go through permissions framework. closes #37
update to latest node-groove. closes #138