DDF-486 changed the filter to call isPermitted against the Subject rather than grabbing an authorizer itself, also set error code correctly