Make QueryController's 403 explain itself