Revert "use AccessDeniedHttpException instead of AccessDeniedException"

Turns out that I was wrong about this in the first place.

In short - `AccessDeniedException` is a lower level Exception, that is picked up by internal listeners, which in turn eventually throw a proper `AccessDeniedHttpException` in its place. Naming is really confusing and unintuitive, but it is what it is.

@weaverryan can probably give a better, more detailed explanation if needed