- membership server returns 403 + human-readable message on missing sealed key (was leaking 'sql: no rows in result set') - client doJSON unwraps the server's {"error"} field instead of pasting the raw HTTP envelope