avoid middleware that handles 404 errors, use 403 status