I'm more comfortable with 404 anyhow, so that we're not confirming the presence. That matters more for user content, but I think it applies to admin areas as well, which make themselves potential targets once the route is located.

Take github for example: [a private repository to which you don't have access](https://github.com/calebthompson/calebthompson.github.com) appears to be a 404.