differentiate 403-vs-404 so we can prompt not-logged-in users to log in #713