Don't always 403 on permission fail if logged out.

Right now we're just doing an ```abort(403)``` on a permission check fail, even if the user is logged out. We should really prompt the user to log in before deciding they don't have permission.