keep right user context for activity-routes, add NoPermission Error, streamline app.auth & make use of custom errors