Resource#permitted? should expect 404 and interpret that as false