add authorization support

Anything that involves modifying user data should be a protected action, and not executable by any user unless they have some sort of granted permission.

Since **brigade_backend** is just a prototype, we don't need anything too complicated, but preferably something that gets the job done while staying out of the way.

The issue names no files, tests, or entry points. Start by surveying the Ruby REST backend and its user-data mutation endpoints, then identify the minimal permission model and tests needed; done means unauthorized users are denied while users with granted permission can modify data.

Written by the indexing model from the issue text.