implement resource-based authorization
unified param, params, prev into ev()
add user data support to ev()
add package.json