serve-sessions.js
function isAuthorized(acl, user) {
    acl = u.str(acl).toUpperCase();
    user = u.str(user).toUpperCase();
    if (user && user === acl) return true;
    if (!aclRe[acl]) {
      aclRe[acl] = reAccess(sessionOpts.acl[acl] || process.env['ACL_' + acl]);
    }
    return aclRe[acl].test(user) || aclRe.ADMIN.test(user);
  }
function isAuthorized(acl, user) {
    acl = u.str(acl).toUpperCase();
    user = u.str(user).toUpperCase();
    if (user && user === acl) return true;
    if (!aclRe[acl]) {
      aclRe[acl] = reAccess(sessionOpts.acl[acl] || process.env['ACL_' + acl]);
    }
    return aclRe[acl].test(user) || aclRe.ADMIN.test(user);
  }
function isAuthorized ( acl , user ) { acl = u . str ( acl ) . toUpperCase ( ) ; user = u . str ( user ) . toUpperCase ( ) ; if ( user && user === acl ) return true ; if ( ! aclRe [ acl ] ) { aclRe [ acl ] = reAccess ( sessionOpts . acl [ acl ] || process . env [ 'ACL_' + acl ] ) ; } return aclRe [ acl ] . test ( user ) || aclRe . ADMIN . test ( user ) ; }
low-level authz api - returns true if user matches or belongs to acl
low - level authz api - returns true if user matches or belongs to acl