Error pages now actually have the appropriate response code
Permissioned Listings now block people who don't have any of those permissions

Before it would just show an empty list, this is a bit more explicit.
Add tests for the various request listings