factor out responses for 404 and 403