`$accessDeniedHandler` could be optional here, to avoid a (tenuous) BC break.