Added respective responses discerning between unauthorized (not logged-in) and forbidden responses.

[Spaarsh]

Closes #10224

fix

Technical

It simply changes the response returned for a authenticated user without the necessary clearance (admin, librarian or super-librarian) to see the /merge/works and adds a condition for responding to a request sent by unauthenticated users.

Testing

The PR affects two cases:

1. Attempt to access the http://localhost:8080/works/merge?records=OL15941796W,OL15400921W by logging into a user type that is not a super-librarian, librarian or admin. If a forbidden response is received, the PR works as expected.
2. Attempt to access the http://localhost:8080/works/merge?records=OL15941796W,OL15400921W without logging-in. If an "unauthorized" response is received, the PR works as expected.

Screenshot

Case 1 - Logged-in but not admin, librarian or super-librarian:

Case 2 - Not logged-in

Stakeholders

@jimchamp

[jimchamp]

Thanks @Spaarsh! This works as expected.