And return the right error code (403, not 401).
Includes TLS authentication, to authorize peers based on the subject of their X509 certificate.