Added permissions to sample users.
Simplify query.
Add authrequired decorator.

It ensures that an auth has been provided.
Use proper function name.
Removed Auth objects.

Just using strings is easier and probably faster.  The only downside is
if you want to find out who has what auths.  Now it requires a full text
search.  But how often will that happen.
Add permission checks.