Get basic authorization logic complete; lookup user by Id, gets its roles, and authorize based on the permissions of the resources on those roles