     # Debatable whether that would be a bug or feature.
     #unless messageRoleCheck(msg.group, msg, 'read', user) and (msg.group == req.gridFS.metadata.group or groupRoleCheck req.gridFS.metadata.group, 'read', user)
     unless canSee msg, false, user
-      res.writeHead 403
+      res.writeHead accessError, accessHeaders req
       return res.end "#{username} lacks read permissions for group of message/file #{msgId}"
 
     ## get()
-    headers = Object.assign {}, accessHeaders(req),
+    headers = Object.assign accessHeaders(req),
       'Content-Type': 'text/plain'
     if req.headers['if-modified-since']
       since = Date.parse req.headers['if-modified-since']  ## NaN if invaild

    #   file: true
    #   root: true  ## for messageRoleCheck
    unless msg? and msg.file and (req.gridFS = findFile msg.file)?
      res.writeHead 403
      ## Use same error message whether file exists or not, so don't leak info.
      #return res.end "Invalid file message ID: #{msgId}"
      return res.end "#{username} lacks read permissions for group of message/file #{msgId}"

  ## Note that this still requires Coauthor authentication via cookies.
  'Access-Control-Allow-Origin': req.headers['origin'] ? '*'
  'Access-Control-Allow-Credentials': 'true'
  'Vary': 'Origin'

## Mimicking vsivsi:file-collection http_access_server.coffee
WebApp.rawConnectHandlers.use '/file',
