Raise exception if non-owner tries to start endpoint

Currently, if someone tries to start an endpoint they are not the owner of, the endpoint UUID will be printed as usual, but the endpoint won't actually start. We should instead reply that they are not authorized to start the endpoint.

Start by locating the endpoint-start request path and trace how ownership is checked and how the endpoint UUID is returned. Change the non-owner path to report that the caller is not authorized, while preserving the existing successful start behavior; add or update a test covering the unauthorized response.

Written by the indexing model from the issue text.