code: function userHasAccess (item) {
         if (typeof item.isSecure !== 'boolean' || item.isSecure === false) {
             // page has no security settings or false, let user pass
             return true;
         } else {
             // page is secured, check if user has access
             var pageRoles = item.roles;
             debug('pageRoles', item.title, pageRoles)
  
             if (Array.isArray(pageRoles) && pageRoles.length === 0) {
                 // page is secured, but requires no specific role
                 if (req.session.user) {
                     // user is authenticated, let pass
                     return true;
                 } else {
                     // user is not authenticated, reject
                     return false
                 }
             }
  
             if (!req.session.user || !req.session.user.roleIds) {
                 // user session does not exist, skip
                 return false;
             }
  
             // make sure roleIds are strings (on first request they are objects)
             var userRoles = [];
             var sessionRoleIds = req.session.user.roleIds;
             for (var r in sessionRoleIds) {
                 userRoles.push(sessionRoleIds[r].toString());
             }
  
             // compare required roles and user roles
             for (var r in pageRoles) {
                 var pageRoleId = pageRoles[r].toString();
                 if (userRoles.indexOf(pageRoleId) !== -1) {
                     // user has role, let pass
                     return true;
                 }
             }
         }
         // all pass rules failed, reject user
         return false;
     }
docs: Returns true if user is allowed to see page