This makes it possible for plugins to return different pages to the user depending on whether the auth failure was authn or authz.
This makes it possible for reverse proxies to transform 403 errors into something like "upgrade to a premium account to access this pad". Also add some webaccess tests.