do not raise HTTPError but send error to client if access forbidden