title: Mongoose/Express authorisation on http verbs
body: <p>I've got a node.js REST service running on mongoose and express. I'm also using merse to get my routing set up. </p>
  
  <p>What I'd like to achieve now are the following types of sceanrios:</p>
  
  <pre><code>Scenario I: e.g. blogpost
  - GET -&gt; no authentication required
  - POST/PUT/DELETE -&gt; authentication required
  
  Scenario II: e.g. user
  - GET -&gt; authentication required
  - POST/PUT/DELETE -&gt; authentication required plus username of logged in user has to match
  </code></pre>
  
  <p>I've allready had a look at everyauth and mongoose-auth, but couldn't find anything which would give me this kind of control. </p>