Add message to `Forbidden` for /Auth resources
Add attribute `restrict_completion`

Some, but not all, attributes need completion to be restricted to
`eligible_object_restriction` of the corresponding E_Type. With
`restrict_completion`, this can be enabled or disabled for various form
elements appropriately.