I'm making some API endpoints that require me to confirm who the user is, and what they can do, before I let them u