Change label style
Add perm constraint; change HTTP status
Change 401 errors to 403

401 is only for a missing WWW-Authenticate header