The only validation function I've written contains this: throw({forbidden: 'Only administrators can write changes'}); IIRC, it raises either a 401 or 403

The only validation function I've written contains this: throw({forbidden: 'Only administrators can write changes'}); IIRC, it raises either a 401 or 403 HTTP error.