- When a list 403s, treat it as if it were empty - When a single resource 403s, redirect to an application error page that has a backdoor link to the tokens page
This is the only way to preserve the URL in all cases.