#2 - base security exception handlers on client side, authorization exception handler