change error code 400 (bad request) to 403 (authorisation required) and update error message to be relevant for both transfer and deletion requests in the event of denying an approval because the user is not authorised for that node