return 404 on permission denied in visitation forms controller