fix(security): Throw a 404 not found when access is denied, to avoid disclosing paths.#72