triggering a AccessDeniedHttpException when authentication fails