Currently, a 500 error is returned, but there should be a 'No Access' message with a 403 code returned.