RBAC in React and Node: enforce the same policy on both sides

The advice is everywhere: the frontend is UX, authorization belongs on the backend. It is true, and...