implement authorization levels

admin workstations can scratch or manifest reserved slots, kiosk
workstations can't
don't let kiosk worstations reserve slots