Let AccessControlHandler return forbidden() rather than NULL