Auth, Business rules and HTTP
How to respond when auth is OK, but business rules preclude an action.
Tags: rails, http