Hmm... for me sendFile stands for sending a file. Nothing more nothing less, so I can't of not agree here. That said I'm not strong on this so if you feel strong for return a error response I would most likely choose 403