They are able to see the link to edit the permissions for a given folder, but then receive a 401 when visiting the link.