Fix works, but no tests yet.

This is not  a real "pull request", more of a "code review request".

Also, I haven't been able to figure out testing, and I wonder if someone could walk me through writing tests.
The "might" was there originally, and I think the point of "might" is that we don't know whether you, user, don't have access because you are logged out (but you do have a username/password combination that gives you access to the resource) or because you are not authorised to use it, and you won't be able to access the resource *even if* you log in.

Also, where does one put an urlBack in the sentence "Please request authorization from the server administrators."?