now throws PermissionDenied instead of 401