A lightweight and flexible access control middleware for Node.js and Express, supporting policy-based authorization