Activity based authorization for Nodejs