Anyone can probe for private repos (BB-200)

There are different responses to requests for a nonexistent repo (404) vs. an existing, private repo (login page, possible access denied for authenticated and nonauthorized users). This allows anyone to probe for the existence of a private repository.