Granular authorization in AngularJS