I thought 404 is for `Not Found` and this should be 403 `Forbidden`