refactor - move currentUser to session and use it to access permissions
refactor - add staffRestricted to authorizeRoute, merge sessionRoute and authorizeRoute
if auth token expires logout