ApiServlet now handles PermissionException instead of handling it as a generic exception.