     #   file: true
     #   root: true  ## for messageRoleCheck
     unless msg? and msg.file and (req.gridFS = findFile msg.file)?
-      res.writeHead 403
+      res.writeHead accessError, accessHeaders req
       ## Use same error message whether file exists or not, so don't leak info.
       #return res.end "Invalid file message ID: #{msgId}"
       return res.end "#{username} lacks read permissions for group of message/file #{msgId}"

    msgId = match[1]

    if req.method == 'OPTIONS'
      res.writeHead 204, Object.assign {}, accessHeaders(req),
        Allow: 'OPTIONS, GET, HEAD'
      return res.end()

    ## handle_auth()

    # Debatable whether that would be a bug or feature.
    #unless messageRoleCheck(msg.group, msg, 'read', user) and (msg.group == req.gridFS.metadata.group or groupRoleCheck req.gridFS.metadata.group, 'read', user)
    unless canSee msg, false, user
      res.writeHead accessError, accessHeaders req
      return res.end "#{username} lacks read permissions for group of message/file #{msgId}"

    ## get()
    headers = Object.assign accessHeaders(req),
      'Content-Type': 'text/plain'
    if req.headers['if-modified-since']
      since = Date.parse req.headers['if-modified-since']  ## NaN if invaild
