Properly raise 403 when trying to access non-owned objects