api/lastfm: do not allow guests to use Last.fm
API.md: add permission denied errors to documentation