Each 401 or 403 answered to a signed-in user or to a request with credentials (an API token) writes "Access denied (status): method path" with the user and the address. Anonymous refusals are left out, so a scanner cannot fill the table.
