using hapi's `auth.scope` instead of pre-ware

I've also relaxed the root admin group requirement for the `/account` resource (except `DELETE`).