Don't throw HTTPAuthorizationException here; throw ModelNotFoundException in model, catch in controller, re-throw as HTTPUnauthorizedException.