If access is denied, http response must have 403 code.