add super basic group authorize handler

to auth only users that belong to backend group