docs: function authorize(req, res, next) {
    var authorized = req.session.authorized;
    var allows = req.route.allows;
    var allowed = false;
  
    if (is.string(allows)) {
      if (is.string(authorized)) {
        allowed = allows === authorized;
      } else if (is.array(authorized)) {
        allowed = authorized.indexOf(allows) > -1;
      }
    } else if (is.array(allows)) {
      if (is.string(authorized)) {
        allowed = allows.indexOf(authorized) > -1;
      } else if (is.array(authorized)) {
        for (var i = 0, l = authorized.length; i < l; i++) {
          allowed = allows.indexOf(authorized[i]) > -1;
  
          if (allowed) {
            break;
          }
        }
      }
    }
  
    debug(`${ req.method } ${ req.path } (${ allows }) : ` +
      `(${ authorized }) --> ${ allowed ? ALLOW : DENY }`);
  
    if (allowed) {
      return next();
    }
  
    res.sendStatus(403);
  }