don't eat some of the authorization exceptions and don't mask them with general 500 error