Api authorisation

Closes #63 
Yeah good catch. I'l try extract it.

Yeah, I thought a bit about the other `if (authorisation.inGroup('admin', this.authenticated)` blocks but they do vary a bit and I think trying to make a general method will affect readability. I'm not super happy about them either though.