ACL missing

[lotar]

Some sort of ACL should be defined

[lotar]

Now I see auth middleware in controllers, define that on routes - it's much easier to track / update that way