Have a look at how I control user access in github.com/nostrocket/flamebucket

It's not complete and I haven't touched it for a while but should give you some ideas