Implement API-level security

[wbprice]

In general:

- An admin should be able to modify questions and answers
- A user should not be able to modify questions and answers
...
- Bunches of other interactions

What is the Hapi tool to allow this?

[ttavenner]

Setup routes for specific actions then set 'config.auth' on the appropriate routes.

http://hapijs.com/tutorials/auth

[qwo]

related to #10 the auth scheme working was using basic auth but google auth + session cookies was ideal. I couldn't get it to work but if someone else knows better feel free to give it a crack.

we could probably do either this

https://github.com/dwyl/hapi-auth-google or
https://github.com/dwyl/hapi-login-example-postgres