AEM 6.1: Require a user to be in a specific group in order to edit content. Other users will only see preview and annotate layers

previewOrAnnotateOnly.js

// This must be in a client library with the category cq.authoring.editor.hook
/* global Granite, CQ, window */
(function($, author, user, http) {
    'use strict';
    var UUID = 'UUID',
    MEMBERS = 'EDITOR_MEMBERS',
    EDITOR_GROUP = '/home/groups/express/express-content-editors',
    PREVIEW = 'Preview',
    ANNOTATE = 'Annotate',
    hideEditLayer = function() {
        var currentLayer = author.layerManager.getCurrentLayer();
        if (currentLayer !== PREVIEW && currentLayer !== ANNOTATE) {
            author.layerManager.setCurrentLayer(PREVIEW);
        }
        author.ui.globalBar.currentLayerButton.element.remove();
        author.ui.globalBar.layerSwitcher.element.remove();
    },
    testGroupMembership = function() {
        var members = window.sessionStorage[MEMBERS],
            uuid = JSON.parse(window.localStorage[UUID])[user.data.userID];

        if (members.indexOf(uuid) < 0) {
            hideEditLayer();
        }
    },
    lookupMembers = function() {
        $.ajax({
            url: http.externalize(EDITOR_GROUP + '.infinity.json'),
            success: function(group) {
                window.sessionStorage[MEMBERS] = group['rep:members'];
                testGroupMembership();
            },
            failure: function() {
                 window.sessionStorage[MEMBERS] = 'could not pull list, received error';
                testGroupMembership();
            }
        });
    },
    determineGroupMembership = function() {
        if (!window.sessionStorage[MEMBERS]) {
            lookupMembers();
        } else {
            testGroupMembership();
        }
    },
    determineUUID = function() {
        $.ajax({
            url: http.externalize(user.data.home) + '.json',
            success: function(jsonResponse) {
                var uuidLookup = JSON.parse(window.localStorage[UUID] || "{}");
                uuidLookup[user.data.userID] = jsonResponse['jcr:uuid'];
                window.localStorage[UUID] = JSON.stringify(uuidLookup);
                determineGroupMembership();
            }
        });
    };

    $(function() {
        if (!user.isInitialized() && user.lazyLoad) {
            user.lazyLoad.call(user);
        }
        if (user.data.userID !== 'admin') {
            if (!window.localStorage[UUID] || !JSON.parse(window.localStorage[UUID])[user.data.userID]) {
                determineUUID();
            } else {
                determineGroupMembership();
            }
        }
    });
})(Granite.$, Granite.author, CQ.shared.User, Granite.HTTP);

I changed the way I was storing UUID lookup so that if you logout and login with another user, it will look for the UUID corresponding to that user ID. Also, I removed the TTL-based storage in favor of a simpler sessionStorage which should be more than sufficient.