LPS-32651 - Instead of setting HttpResponse status SC_FORBIDDEN  directly, Use SC_NOT_FOUND status and set it with PortalUtil.sendError(..).

This way server does expose hidden DM structures.