title: Query fetched some unauthorised data: Filter or block
body: <p>I am using Spring-data-rest but this can be general question. If I am creating a REST service and the authenticated user makes a REST query which fetched some data that is unauthorised, should the response be 403 or should I filter out the data that is unauthorised and send the rest.</p>
  
  <p>Another case could be such that the user requests data is completely unauthorised. In such a case, should the response be 403 or 404?</p>