Api authorisation

Closes #63 
Just as an aside; in coffeescript the return will be implicit if you leave it out. So e.g. you could write the above like this
```
exports.inGroup = (group, user) -> user.groups.indexOf(group) >= 0
```
Personally I think that's quite a nice feature in terms of readability, esp. with when it comes to all these higher-order functions in JS.

But this isn't a review comment, no need to change (esp. if you knew about this feature and just preferred your way! :) )