throw 404 instead of 403 on invalid permissions