Use separate errors for cookbook create/destroy authorization

Knife expects any unauthorized destroy action to return a empty body and
a 403 response whereas cookbook create expects a body with an error code
and error messages and a 400 response. This accounts for the differences
between how each action should respond when authorization fails.