Alternatively, would a 403 response suffice?