Front-end permissions (WIP)

TODO: update documentation to cover the new route/serve API
Couple of issues:
- If the user already has a session cookie, their access to the restricted area will not be limited to the current browser session.
- If the user logs into a protected section then logs into the admin. Their login to the admin will expire at the end of the browser session.