When a user tried to unpin a status not belonging to them, a full MastoAPI response was sent back even if status was not visible to them. Ditto with (un)mutting except ownership.