Check permission before deleting objects
Use some helpful HTTP status codes, not just generic 422.

* 403 for PermissionDeniedError
* 401 for UnauthorizedError