update tests to reflect the change back from Http404 to PermissionDenied