Not sure why there would be HTTP permissions on something that isn't attempted to be retrieved until after a product code is checked for legitimacy.