Access control should have onErr callback, and pass '403 Unauthorized' to accept callback on unauthorized access