change bad-request to forbidden when access is denied (ACL)