Use session cookie plus in-memory server sessions scheme.
Add /login /logout POST routes: {"data": ["username", "password"]}.
Add authorization plugin with arbitrary authorization callbacks.
Add valid user and user in group authorization callbacks.
Require valid user authorization for all routes (besides login/logout).
Use session cookie plus in-memory server sessions scheme. Add /login /logout POST routes: {"data": ["username", "password"]}. Add authorization plugin with arbitrary authorization callbacks. Add valid user and user in group authorization callbacks. Require valid user authorization for all routes (besides login/logout).