Should be 401 for unrecognized credentials, 403 for an existing user who doesn't have access to a particular object, 404 for a missing object.

We _used to return_ 404 in the two latter cases. With the introduction of RBAC, this no longer makes sense: for any user, there are chances of seeing an object they can not manipulate.