All security tasks, such as authorization and authentication, must be managed by the server. It is so easy to get around them in the client, making all auth / acl operations in the client irrelevant. Use session and cookies to manage this server implementation.
. userSession.js