Report allowed actions in cross-user object requests, with the 'X-Object-Allowed...