show 404 page instead of "permission denied"