docs: add documentation about /admin route permissioning
we should document in README.md about user groups

for example...

```md
By default, all users are assigned to the "user" group.  This group is defined in the user model under `app/models/user.js` per the property `'group'``.

This approach was inspired by classic Linux-based user-group permissioning.

We've also added a default policy helper to detect whether or not a user an admin, which you can add as a middleware before your controller logic.

For example, if you want to restrict access to all `/admin` routes, you can add this simple middleware:
```

```js
router.all('/admin*', policies.ensureAdmin);
```

```md
**This simple middleware is automatically added by default for you.**

If you'd like to grant yourself admin access to the `/admin` routes, then you can run this script (replace with your email address and database name):
```

```sh
mongo lad_development --eval 'printjson(db.users.update({ email: "niftylettuce@gmail.com" }, { $set: { group: "admin" }}));'
```