Just serve 404 if ACL check fails.