Since this is an access error, should it raise HTTP/403?