Support partial success on 403s in CN script

[bickelj]

Suppose there is one changemaker that denies permission to the user running the script. The script should continue with partial success, especially given that the default is deny.