Not clear LRS has discretion to reject statements

[garemoko]

See #497 (comment) and following discussion.

The description of error code 403 clearly envisages that LRS can prevent APs performing certain actions based on permissions. This is a bit buried in the error codes section though. Further, various requirements along the lines of "MUST accept" or "MUST NOT reject" (where we're saying the LRS mustn't reject something on certain grounds) may be taken to imply that the LRS has to accept anything.

I propose we add a descriptive paragraph at the start of 7.0 explicitly stating that the LRS can reject requests based on permissions and that definition of what those permissions are is out of scope of the specification. I suggest this is a patch change.

[bscSCORM]

👍 (which is hardly surprising as this issue is based on my comment)