front end part of the admin permission handling

changed the notifications for adding a course to be more expressive,
also fixed the default route in routes.js, also worth noting: I'm
using status 422 for not allowed because 401 is always handled by
a specific event handler and I'd rather not lose too much time with
that for now