removed canView() - always true, if false server sends Unauthorized response.