-// - unauthenticated /index/{prefix} request
-// - unauthenticated /index request
-// - authenticated /index request, non-superuser
-// - authenticated /index request by superuser, enforce_permissions = false
-// - authenticated /index request by superuser, enforce_permissions = true
+// - enforce_permissions off, unauthenticated /index request
+// - enforce_permissions off, authenticated /index request, non-superuser
+// - enforce_permissions off, authenticated /index request, superuser
+// - enforce_permissions on, unauthenticated /index request
+// - enforce_permissions on, authenticated /index request, non-superuser
+// - enforce_permissions on, authenticated /index request, superuser
+// - enforce_permissions on, authenticated /index/prefix request, superuser
+//
+// The only /index requests that should succeed are those issued by the
+// superuser when enforce_permissions = true.