try to use json, add denied handler