TestClient: log DENIED responses