Return a 403 if the user is not authorized, not 401
Add helper methods to the json server spy class so we can capture and retreive sent headers
New unit tests for capability checks and allow header sending checks