feat: work on accessAPI pages (GET and POST)

CHANGES.md

@@ -1,5 +1,9 @@
 # CHANGES for nogin
 
+## ?
+
+- feat: `/groups` page
+
 ## 6.5.0
 
 - feat: `/users` page delete ability for root users

README.md

@@ -277,8 +277,8 @@ export default function fallback (req, res, next) {
 
 - `--router` - This is where your own (Express) app should be. Note: The following
     paths should not be set as they are reserved by nogin:
-    - POST: `/login`, `/logout`, `/home`, `/signup`, `/lost-password`, `/reset-password`, `/delete`, `/reset`
-    - GET: `/login`, `/home`, `/signup`, `/reset-password`, `/activation`, `/users`,  `/coverage`, `/api` (reserved for possible future use)
+    - POST: `/login`, `/logout`, `/home`, `/signup`, `/lost-password`, `/reset-password`, `/delete`, `/reset`, `/accessAPI`
+    - GET: `/login`, `/home`, `/signup`, `/reset-password`, `/activation`, `/users`,  `/coverage`, `/accessAPI`, `/groups`, `/privileges` (reserved)
 
 ```js
 /**
@@ -532,7 +532,10 @@ For developing docs, see [DEVELOPING](./docs/DEVELOPING.md).
 ## Lower priority to-dos
 
 1. Add `/user/<username>` (GET) script for admins and others
-1. Add `/api` (GET) to explain API and also possibly consolidate to one page?
+1. Add `/group/<groupname>` (GET) script for admins and others
+1. Add to `/accessAPI` (GET) to explain API and also possibly consolidate
+    to one page?
+1. Could make groups hierarchical (multiple? inheritance privileges)
 1. Allow variant of `localScripts` which uses CDN but generates fallback
 1. Option to **email forgotten username** (as a workaround, the reset
     password email will send this currently, but not if adding an option to