modified a wrong design, change 405 to 403 when permission check is failed, and change http code from 405 to 404 when the resource is None.