403 errors return json if appropriate
Improve access_map in auth.py
Update debian/changelog