Simple, powerful, and extendable access control for Node and the browser