Indentation fixes
Auth check in frontend screen setup (+test)

Also prefer 403s over redirects for screen API auth failures.