MayRead checks if caller may read up to size bytes, and return a url that the
caller may read from, or an error describing why the operation is forbidden.
MayWrite checks if caller may write up to size bytes, and return a url that the
caller may write to, or an error describing why the operation is forbidden.