LPS-32651

Hi Samuel,

I propose following solution to this issue.

Adding  

response.setStatus(HttpServletResponse.SC_FORBIDDEN);

was wrong, but changing that to 

response.setStatus(HttpServletResponse.SC_NOT_FOUND);

would not be good either, since then the result would have been empty as we will provide also nice error page for these. 

The correct way was to use PortalUtil.sendError(..) to do the job.