diff --git a/core/modules/hal/tests/src/Functional/EntityResource/Shortcut/ShortcutHalJsonAnonTest.php b/core/modules/hal/tests/src/Functional/EntityResource/Shortcut/ShortcutHalJsonAnonTest.php
index 946f517..ae49987 100644
--- a/core/modules/hal/tests/src/Functional/EntityResource/Shortcut/ShortcutHalJsonAnonTest.php
+++ b/core/modules/hal/tests/src/Functional/EntityResource/Shortcut/ShortcutHalJsonAnonTest.php
@@ -33,48 +33,18 @@ class ShortcutHalJsonAnonTest extends ShortcutResourceTestBase {
   /**
    * {@inheritdoc}
    */
-  protected static $expectedErrorMimeType = 'application/json';
-
-  /**
-   * {@inheritdoc}
-   */
   protected function getExpectedNormalizedEntity() {
   $default_normalization = parent::getExpectedNormalizedEntity();
 
   $normalization = $this->applyHalFieldNormalization($default_normalization);
 
-  $author = User::load(0);
   return  $normalization + [
     '_links' => [
       'self' => [
       'href' => $this->baseUrl . '/admin/config/user-interface/shortcut/link/1?_format=hal_json',
       ],
       'type' => [
-      'href' => $this->baseUrl . '/rest/type/shortcut/shortcut',
-      ],
-      $this->baseUrl . '/rest/relation/shortcut/shortcut/user_id' => [
-      [
-        'href' => $this->baseUrl . '/user/0?_format=hal_json',
-        'lang' => 'en',
-      ],
-      ],
-    ],
-    '_embedded' => [
-      $this->baseUrl . '/rest/relation/shortcut/shortcut/user_id' => [
-      [
-        '_links' => [
-        'self' => [
-          'href' => $this->baseUrl . '/user/0?_format=hal_json',
-        ],
-        'type' => [
-          'href' => $this->baseUrl . '/rest/type/user/user',
-        ],
-        ],
-        'uuid' => [
-        ['value' => $author->uuid()]
-        ],
-        'lang' => 'en',
-      ],
+      'href' => $this->baseUrl . '/rest/type/shortcut/default',
       ],
     ],
     ];
@@ -87,7 +57,7 @@ protected function getNormalizedPostEntity() {
   return parent::getNormalizedPostEntity() + [
     '_links' => [
       'type' => [
-      'href' => $this->baseUrl . '/rest/type/shortcut/shortcut',
+      'href' => $this->baseUrl . '/rest/type/shortcut/default',
       ],
     ],
     ];
diff --git a/core/modules/hal/tests/src/Functional/EntityResource/Shortcut/ShortcutHalJsonBasicAuthTest.php b/core/modules/hal/tests/src/Functional/EntityResource/Shortcut/ShortcutHalJsonBasicAuthTest.php
index b4e3655..a5be6db 100644
--- a/core/modules/hal/tests/src/Functional/EntityResource/Shortcut/ShortcutHalJsonBasicAuthTest.php
+++ b/core/modules/hal/tests/src/Functional/EntityResource/Shortcut/ShortcutHalJsonBasicAuthTest.php
@@ -2,7 +2,6 @@
 
 namespace Drupal\Tests\hal\Functional\EntityResource\Shortcut;
 
-use Drupal\Tests\hal\Functional\HalJsonBasicAuthWorkaroundFor2805281Trait;
 use Drupal\Tests\rest\Functional\BasicAuthResourceTestTrait;
 
 /**
@@ -22,9 +21,4 @@ class ShortcutHalJsonBasicAuthTest extends ShortcutHalJsonAnonTest {
    */
   protected static $auth = 'basic_auth';
 
-  // @todo Fix in https://www.drupal.org/node/2805281: remove this trait usage.
-  use HalJsonBasicAuthWorkaroundFor2805281Trait {
-    HalJsonBasicAuthWorkaroundFor2805281Trait::assertResponseWhenMissingAuthentication insteadof BasicAuthResourceTestTrait;
-  }
-
 }
diff --git a/core/modules/hal/tests/src/Functional/EntityResource/Shortcut/ShortcutHalJsonCookieTest.php b/core/modules/hal/tests/src/Functional/EntityResource/Shortcut/ShortcutHalJsonCookieTest.php
index 78fe3ae..a48a61f 100644
--- a/core/modules/hal/tests/src/Functional/EntityResource/Shortcut/ShortcutHalJsonCookieTest.php
+++ b/core/modules/hal/tests/src/Functional/EntityResource/Shortcut/ShortcutHalJsonCookieTest.php
@@ -3,7 +3,6 @@
 namespace Drupal\Tests\hal\Functional\EntityResource\Shortcut;
 
 use Drupal\Tests\rest\Functional\CookieResourceTestTrait;
-use Drupal\Tests\rest\Functional\EntityResource\Shortcut\ShortcutResourceTestBase;
 
 /**
  * @group hal
diff --git a/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php b/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php
index 822d8d7..a90ca56 100644
--- a/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php
+++ b/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php
@@ -407,7 +407,7 @@ public function testGet() {
     ksort($expected);
     $actual = $this->serializer->decode((string) $response->getBody(), static::$format);
     ksort($actual);
-    $this->assertSame($expected, $actual);
+    $this->assertEquals($expected, $actual);
 
     // Not only assert the normalization, also assert deserialization of the
     // response results in the expected object.
@@ -470,7 +470,7 @@ public function testGet() {
       ksort($expected);
       $actual = $this->serializer->decode((string) $response->getBody(), static::$format);
       ksort($actual);
-      $this->assertSame($expected, $actual);
+      $this->assertEquals($expected, $actual);
     }
 
 
diff --git a/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutJsonAnonTest.php b/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutJsonAnonTest.php
index bbeb2b4..8f317b3 100644
--- a/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutJsonAnonTest.php
+++ b/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutJsonAnonTest.php
@@ -21,9 +21,4 @@ class ShortcutJsonAnonTest extends ShortcutResourceTestBase {
    */
   protected static $mimeType = 'application/json';
 
-  /**
-   * {@inheritdoc}
-   */
-  protected static $expectedErrorMimeType = 'application/json';
-
 }
diff --git a/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutJsonBasicAuthTest.php b/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutJsonBasicAuthTest.php
index e07664d..31f1117 100644
--- a/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutJsonBasicAuthTest.php
+++ b/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutJsonBasicAuthTest.php
@@ -3,7 +3,6 @@
 namespace Drupal\Tests\rest\Functional\EntityResource\Shortcut;
 
 use Drupal\Tests\rest\Functional\BasicAuthResourceTestTrait;
-use Drupal\Tests\rest\Functional\JsonBasicAuthWorkaroundFor2805281Trait;
 
 /**
  * @group rest
@@ -30,16 +29,6 @@ class ShortcutJsonBasicAuthTest extends ShortcutResourceTestBase {
   /**
    * {@inheritdoc}
    */
-  protected static $expectedErrorMimeType = 'application/json';
-
-  /**
-   * {@inheritdoc}
-   */
   protected static $auth = 'basic_auth';
 
-  // @todo Fix in https://www.drupal.org/node/2805281: remove this trait usage.
-  use JsonBasicAuthWorkaroundFor2805281Trait {
-    JsonBasicAuthWorkaroundFor2805281Trait::assertResponseWhenMissingAuthentication insteadof BasicAuthResourceTestTrait;
-  }
-
 }
diff --git a/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutJsonCookieTest.php b/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutJsonCookieTest.php
index bfcc0ec..3a043c8 100644
--- a/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutJsonCookieTest.php
+++ b/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutJsonCookieTest.php
@@ -24,11 +24,6 @@ class ShortcutJsonCookieTest extends ShortcutResourceTestBase {
   /**
    * {@inheritdoc}
    */
-  protected static $expectedErrorMimeType = 'application/json';
-
-  /**
-   * {@inheritdoc}
-   */
   protected static $auth = 'cookie';
 
 }
diff --git a/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutResourceTestBase.php b/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutResourceTestBase.php
index 0b3eca2..51064f6 100644
--- a/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutResourceTestBase.php
+++ b/core/modules/rest/tests/src/Functional/EntityResource/Shortcut/ShortcutResourceTestBase.php
@@ -3,6 +3,7 @@
 namespace Drupal\Tests\rest\Functional\EntityResource\Shortcut;
 
 use Drupal\shortcut\Entity\Shortcut;
+use Drupal\shortcut\Entity\ShortcutSet;
 use Drupal\Tests\rest\Functional\EntityResource\EntityResourceTestBase;
 
 /**
@@ -78,7 +79,7 @@ protected function getExpectedNormalizedEntity() {
     ],
     'id' => [
     [
-      'value' => '1',
+      'value' => (int) $this->entity->id(),
     ],
     ],
     'title' => [
@@ -88,7 +89,9 @@ protected function getExpectedNormalizedEntity() {
     ],
     'shortcut_set' => [
     [
-      'value' => 'default',
+      'target_id' => 'default',
+      'target_type' => 'shortcut_set',
+      'target_uuid' => ShortcutSet::load('default')->uuid(),
     ],
     ],
     'link' => [
@@ -108,6 +111,11 @@ protected function getExpectedNormalizedEntity() {
       'value' => 'en',
     ],
     ],
+    'default_langcode' => [
+      [
+        'value' => TRUE,
+      ],
+    ],
   ];
   }
 
@@ -123,11 +131,30 @@ protected function getNormalizedPostEntity() {
     ],
     'link' => [
     [
-      'uri' => 'internal:/admin/content/comment',
+      'uri' => 'internal:/', # 'internal:/', 'route:<front>', 'route:<test>', ...?
     ],
     ],
       'shortcut_set' => 'default',
     ];
   }
 
+  /**
+   * {@inheritdoc}
+   */
+  protected function getExpectedUnauthorizedAccessMessage($method) {
+    if ($this->config('rest.settings')->get('bc_entity_resource_permissions')) {
+      return parent::getExpectedUnauthorizedAccessMessage($method);
+    }
+
+    switch ($method) {
+      case 'GET':
+      case 'POST':
+      case 'PATCH':
+      case 'DELETE':
+        return "The 'access shortcuts, customize shortcut links' permissions is required.";
+      default:
+        return parent::getExpectedUnauthorizedAccessMessage($method);
+    }
+  }
+
 }
diff --git a/core/modules/shortcut/shortcut.module b/core/modules/shortcut/shortcut.module
index 156b491..037feca 100644
--- a/core/modules/shortcut/shortcut.module
+++ b/core/modules/shortcut/shortcut.module
@@ -65,7 +65,10 @@ function shortcut_set_edit_access(ShortcutSetInterface $shortcut_set = NULL) {
   // Sufficiently-privileged users can edit their currently displayed shortcut
   // set, but not other sets. They must also be able to access shortcuts.
   $may_edit_current_shortcut_set = $account->hasPermission('customize shortcut links') && (!isset($shortcut_set) || $shortcut_set == shortcut_current_displayed_set()) && $account->hasPermission('access shortcuts');
-  return AccessResult::allowedIf($may_edit_current_shortcut_set)->cachePerPermissions();
+  if (!$may_edit_current_shortcut_set) {    
+    return AccessResult::neutral("The 'access shortcuts, customize shortcut links' permissions is required.")->cachePerPermissions();
+  }
+  return AccessResult::allowed()->cachePerPermissions();
 }
 
 /**