Not allowed isn't exactly appropriate...

We could also return `{"success": false}` ?