feat: documentation on rbac middleware

Content-length is not normally zero on a 403 error; body usually specifies some kind of message as to why; even if it a very generic message such as "Not Authorized".