use throwaway contexts in deny functions; we shouldn't use the current server context because it might not match the current client context