when test or role check fail, it raises a Forbidden error instead of logout