Does not getting user for specified ID translates to 404, can it also be 403 (Unauthorized)? If so how can we distinguish?