Api authorisation

Closes #63 
Not a big deal, but I see this is the same code as https://github.com/jembi/openhim-core-js/blob/api-authorisation/src/api/transactions.coffee#L131-L137. A good candidate for refactoring into a common method? Don't know if the same could be done for all the `if (authorisation.inGroup('admin', this.authenticated)` sections due to the `this` var, but anyway...