rather than duplicating logic, call validateAccess, catch Unauth' and return false.