Fix incorrect 401 vs 403 response, if lazy authentication has not taken place.
Add object permissions tests.