tests for 404 access denies