Need a way for the client to distinguish between authenticated (certain)
and unauthenticated (likely) author SIDs in the context of a bundle list,
since the bundle list does not verify manifest signatures for performance
and battery life reasons.
List all the HTTP status codes in the REST API tech doc.
Only use 403 Forbidden for requests originating from a disallowed
origin (ie, not localhost).
- Return 400 for missing, unknown, duplicate and out-of-order form
parts in POST requests.
- Return 415 Unsupported Media Type for unsupported form part
Content-Disposition and Content-Type (including unsupported
charset).
- Return 414 Request-URI Too Long for any buffer exhaustion while
parsing request.
- Return 419 Authentication Timeout for missing crypto secret.