Using AccessDeniedException instead of NotFoundException (http code 403 instead of 404)