Problem: Our current authorization scheme was hand built, does not follow know patters and is quite confusing. It would be better to move to something that is considered standard. Perhaps Access Control Lists.

Acceptance Criteria: Upgrade authorization components to a specified standard approach