rework policies to use permissions over roles

client/src/api/axios.ts

@@ -87,4 +87,7 @@ api.interceptors.response.use(response => response, async error => { // mainly f
     return Promise.reject(error);
 })
 
+// TODO: if you get a 403 while navigating then redirect to the last authenticated page
+// if you gert a 403 on a form submissio nthen do like an unauthorized popup
+
 export default api;