I want my controller to return the right HTTP response code when the user lacks permission to view a particular page.