You want to use the FOR EACH syntax or the TRAVERSE  function which is the equivalent of $ORDER.  Here is a link to the documentation online

http://docs.intersystems.com/latest/csp/docbook/DocBook.UI.Page.cls?KEY…

Do you have any data transformations along the way?  If so be sure to move the %Source property.

There are a number of reasons why building a REST service off a CSP page would be bad.  They all come down to that a CSP page does not implement all the features of a "proper" REST service.  REST is really not that difficult in Cache once you get the basics down.  Just to be sure you are looking at the right documentation here is a link to the most recent.  

http://docs.intersystems.com/latest/csp/docbook/DocBook.UI.Page.cls?KEY…

It is not clear from your question if this is in Cache or Ensemble.  In practice setting up the service itself is best done in Cache even in you are using Ensemble.  EnsLib.REST.Service does not, as of yet, provide a full implementation of the %CSP.REST class that it inherits from.   It WILL work, however there may be some features of %CSP.REST that you can not take advantage of.  I don't have a list of those.  Post a follow up question if that is of interest and the information can be dug up. 

When you look at a REST service call from you need to breakdown the URL to understand how this is implement in Cache.  Take www.somecompany.com/api/v1/person/1,  there are three sections we are worried about

server:  www.somecompany.com

CSP Web Application: /api/v1  - this is setup in the system management portal under security->Applications-

resource being accessed: /person/1 - this is mapped in a Class that inherits from %CSP.REST in an XDATA block as shown below.  The '1' in this case is a data value indicating which person record you want to access and is also part of the mapping.  Here is what that class might look like:

Class Example.RESTservice extends %CSP.REST {

XData UrlMap [ XMLNamespace = "http://www.intersystems.com/urlmap" ]
{
<Routes>
<Route Url="/Person/:ID" Method="Get" Call="RetrievePerson" />
<Route Url="/test" Method="GET" Call="TestService" />
</Routes>
}

Classmethod RetreivePerson(ID as %String) as %Status

{

// code to retreive the person record and format the response which is simple "written" out from this method

//be sure to put a proper HTTP status in the %response.status property and a correct content type

// (ie. application/json) in %response.ContentType

}

}

Note the :ID in the map of the URL. This indicates a data value that is to be passed to the class method that is called.  If there are multiple data values they are passed to each parameter of the method in order they occur.  The name in the URL has no real meaning.  These data parameters can also appear in any place in the URL so www.somecompany.com/api/v1/1/person could also be a valid URL.

Now tie this together by putting your REST class name that you just created (ie Example.RESTservice) in the Dispatch Class field of the web application.  Now anything that is part of the URL that is past the CSP web application will be forwarded to the dispatch class to be handled.

Hope this helps

I had a client that had this exact problem.   The JSON interfaces that exist today intentionally try to take a concise approach rather than try to provide options to handle every possible situation.   Bottom-line is that this means for this situation you will need to create your own method of handling this.  The good is that this is not necessarily too difficult to create a flexible methodology to do this.  

What my client did was to create a code generation method that would introspect on the class definition at compile time and produce a method that would build a Proxy object (old way, 2016 and higher would use Dynamic Object structures) of exactly what they wanted to have in the JSON.  Then the method to produce the JSON from an object would use the Proxy or Dynamic object.   For this client they created a parameter on the class that provided direction regarding how to handle collection properties.  

It may also be possible to create a general utility class that defines  new property parameters to manage this and the code generation method.   Then have the your classes inherit from this to add in the desired functionality. 

Just so happens I just installed an instance on CentOS.  I can edit my config.  Here is the permissions that are on my cache.cpf file.  Compare them to yours.  The xxxx is the user I chose as the owner.

-rw-rw-r--. 1 xxxx cacheusr 21901 Apr 22 22:15 cache.cpf 

Two suggestions:

1.  try returning a different error message.  One that might indicate an authentication error such as $SYSTEM.Status.Error($$$UserInvalidPassword).  I have not tried it myself, but this may work.  However, as someone else said this is really not the intended purpose of delegated authentication.  
2. I am not sure about the nature of your additional checks.  However perhaps you can use the Login tag in %Zstart.

These are just suggestions as I have not had the chance to try either yet.