Thrown by a route, a service or a remote fetch to answer the request with an error. The error middleware sends it as an APIFailure, message included, so the message must be fit for the user. Use 401 for a caller who isn't signed in, 403 for one who is but may not, and 404 rather than 403 when the caller mustn't learn that the thing exists.