auth/casbin readme and example

It's not clear to me how `auth/casbin` is meant to be used. I had a look at the test cases but it looks like that's just using hard-coded values. Are we meant to wrap this with our own middleware that injects the subject & object and populates the context with the model & policy or is this just meant to serve as an example implementation?

Would be good to have a readme to add a little more context...