what's the idea behind this change? in some ways it seems cleaner to have the caller be able to choose what they want to do with `PermissionDenied` than to force a 404. you could always add a second decorator that just traps `PermissionDenied` and reraises `Http404` if it's just for convenience