KNOX-270: service level authorization should return 403 on deny