Raise PermissionDenied instead of HttpResponse. Fixes #314.