Permission checking in user.create().

src/api.js

@@ -220,7 +220,21 @@ Api.fn.user = {
 			throw Api.err.INVALID_PARAMS;
 		}
 
-		return this.users.create(p_email, p_pass, p_perm).then(function (user) {
+		var user_id = session.get('user_id');
+		if (undefined === user_id)
+		{
+			throw Api.err.UNAUTHORIZED;
+		}
+
+		var users = this.users;
+		return users.get(user_id).then(function (user) {
+			if (!user.hasPermission('admin'))
+			{
+				throw Api.err.UNAUTHORIZED;
+			}
+
+			return users.create(p_email, p_pass, p_perm);
+		}).then(function (user) {
 			return (''+ user.get('id'));
 		});
 	},

src/xo.js

@@ -162,6 +162,7 @@ function Xo()
 	this.users.add({
 		'email': 'bob@gmail.com',
 		'pw_hash': '$2a$10$PsSOXflmnNMEOd0I5ohJQ.cLty0R29koYydD0FBKO9Rb7.jvCelZq',
+		'permission': 'admin',
 	}).done();
 
 	// This events are used to automatically close connections if the