It is, but I put a 404 for not inform user that this collection exists.
If he wanted to do something that it doesn't have the right to I don't want him to know that he did the right request.