support the "entitlement" header for distinguishing between person-not-found and authentication-system-failure