Kane,
Yes, both source and target are current users. If I remove the headers, I get back an HTML page that says “Oops! That page doesn’t exist or is private.” The “page doesn’t exist” part is understandable for a 404 error, but I’m not sure what “private” implies here.
Mark