simple hapi role & permission auth