I've changed it to HttpException and AccessDeniedException. I'm not sure what status code should I sent when there is not XmlHttpRequest request header available and if it`s better to throw HttpException/AccessDeniedException instead of JsonResponse('Error', 403);