res.json(): defaults to {"success": true}
app_modules: load configured ones as files or directories
app_modules/userman: user auth*s with role and password; minimal backend bones
app_modules/userman: check `req.session` first, auth fail handling
res.json(): fix bug with non ASCII string length
app_modules/userman: login then authentification

* '/login' creates `res.session`, thus saving state
  `res` has roles for user id sent

* '/auth' checks role, password and creates
  `req.session.user` authorization object
  example:
        if(req.session.user.can['App.back.JS'] &&
           req.body.plain_text
        ){
            do_back_js(req.body.plain_text)
	}
first authorization application: App.back.JS