Return a proper JSON request for permission_denied if the request.type is for JSON
Render an error message in the checklist partial if they attempt to view a checklist they do not have access to