probeAccess

Reports the access the user effectively holds on uri, from its WAC-Allow header.

An indeterminate outcome (a 401 blip, 5xx, transport error) throws — it does not come back as AccessProbe.Denied. Never treat a failure here as a denial.