use $app->abort(403, 'Access forbidden'); instead