Authorization:
1. client:
+ add 'permissions' in route config
+ add 'auth-interceptor' to listen http response status 401
+ listen 'routeChangeStart' & 'locationChangeStart' to check authorization.js

2. server:
- add auth.accept(role1, role2) to set authorization to routes