Is this really a 404 ? It seems like a permission check (403).