Set status 412 on security exceptions

One could argue for 403, but I think 412 is more appropriate.