Handling of non-viewable spaces is inconsistent and leaks information

According to our stated security goals, if a user does not have permission to view a space they should not receive any indication that the space does (or might) exist. As such, any attempt to perform an action on a space the user can not see should have the same result as if the space did not exist.

In a number of places, users get a "not permitted" message for spaces that exist, but a "not found" message for spaces that do not. We should audit the various space actions (probably making them implement SpaceAware as the SpaceAwareInterceptor deals with this case correctly), and also the remote API.

(This issue arises from CONF-9239)