neat

tangential bit - the login_and_domain_required also raises 404 when permission isn't allowed for the user. perhaps on the backend we should log for ourselves true 404's vs. other differences (and still keep it presentable as 404 to the client)