Rather than 401 via ring middleware, macros

401.clj

(defn request* [method route-path privilege route-params handler]
  `(~method ~route-path ~route-params
        (fn [req#] (let [user# (get-in req# [:session :current-user])]
                    (if (access/has-access? user# ~privilege)
                      (~handler req#)
                      ~response-401)))))

(defmacro GET* [route-path privilege route-params handler]
  (request* `GET route-path privilege route-params handler))

(defmacro POST* [route-path privilege route-params handler]
  (request* `POST route-path privilege route-params handler))

;; When implementing a middleware to do an access check on a route,
;; there are a few problems:
;; 1. Maintenance of separate route->perm map
;; 2. Failing, responding w/ 401, prevents other handlers from
;;    firing