This should return a 404 or 403, not throw an exception.