code: function protect_roles(app, config, prefix) {
  
      for (var path in config) {
  
          init_debug("Protecting path: " + prefix + path);
  
          var allow = true;
          if (config[path].action === "deny")
              allow = false;
  
          init_debug("Allow: " + allow);
  
          for (var method in config[path]) {
  
              init_debug("Protecting method: " + method);
  
              if (method != "action") {
  
                  var config_array = config[path][method];
  
                  app[method](prefix + path, (function (allow, conf) {
  
                      return function (req, resp, next) {
  
                          running_debug("config roles: " + conf);
                          running_debug("req roles: " + req.user.roles.toString());
  
                          var active_roles = _.intersection(conf, req.user.roles);
  
                          running_debug("active roles: " + active_roles);
  
  
                          if (active_roles.length > 0) {
                              running_debug("active roles > 0");
                              if (allow) {
                                  running_debug("path allowed");
  
                                  req.user.authorized_roles = _.union(req.user.authorized_roles, active_roles);
  
                              } else {
                                  running_debug("path not allowed");
                                  req.user.authorized_roles = _.difference(req.user.authorized_roles, active_roles);
                              }
                          }
                          next();
                      };
  
                  })(allow, config_array));
              }
          }
      }
  
  }
docs: -------------------------------------- 
  Install protecting routes into the app express application. Roles are defined in the config
  @param   {Object} app    The expressjs application to protect with
  @param   {Object} config Define the path/method/roles configuration
  @param {String} The prefix string of each path to protect