can now hit user route (get, post, delete). Coded in some checks to see
if user is admin and has privledge. Currently turned off to allow work
from curl
added api.go where api routes will be built (will move code from
server.go in the future to api.go that fits that) and coded out the
category route (delete, post, and get)
