404 error should say "not found or you're not authorized"

I've received a 404 not found error from debusine for a private workspace while not being logged in, that should have been a 403 forbidden or 401 unauthorized. Perhaps the reason to return 404 is to not leak the fact that the private workspace exists, in which case maybe we should turn all 404 errors from Workspace foo not found in scope bar to Workspace foo not found in scope bar, or you need to log in to see it or Workspace foo not found in scope bar, or you are not authorized to see it.