For REST resources that do not exist, when to return 404 and when to return 403?

I am familiar with the logic, that if you wish to authenticate someone with username and password, you should return the same error, no matter if the username is not found, or if the password is wrong. The idea being, that if you returned separate "user not found" and "user found, but password wrong" errors, an attacker could at try all usernames and at find out which usernames are valid, then concentrate their dictionary attacks only on those usernames.

With a REST service, I have a resource which only certain users can access, let's call it /foo/{id}. So there are various cases:

1. A user attempts to access /foo/4 and they have access, they obviously get a 200 response and the resource.

2. A user attempts to access /foo/3 and it doesn't exist. (I cannot tell if they would have had access to it if it did exist, as it doesn't exist. Think a non-existent photo on Facebook, a photo only has ownership information when it exists.)

3. A user attempts to access /foo/4, it exists, but they do not have access.

So my question is, what return codes to return in case 2 and 3? As far as I can see there are the options:

1. Return 404 for case 2, and 403 for case 3. But that means an attacker can find out which objects exist, similar to the password example in the first example.

2. Return 404 for all examples, after all, from the perspective of the user, the resource they don't have access to "doesn't exist", if they list all the resources they have access to that resource will not be in the list.

3. Return 403 for all examples.

What would you do? What is the standard here?