Do not expose names of existing security groups when user requests are unauthorised

Hello, 

This pull request is to ensure that the names of security groups are not exposed to the outside world in the form of a HTTP response, when a user request is unauthorised. 

This information is now logged to the log file and a simpler, less detailed error messaged is returned to the client, exposing less of the server's internal state. 

Matt