[Security] fixed error 500 instead of 403 if previous exception is provided to AccessDeniedException
[Security] made code easier to understand, added some missing unit tests