better access_denied response
new verification scenarios