AccessDeniedException may not be wrapped; we still need to rethrow it.
Trivially reproducible by configuring Jenkins to not be anonymously readable, and logging out.