security interceptor must throw BusinessException