in src/main/java/org/apache/sling/starter/access/models/AccessFormPage.java [50:60]
protected void init() throws IOException {
if (!getCanReadAccessControl()) {
if (request.getRemoteUser() == null) {
// 404 for anonymous
response.sendError(HttpServletResponse.SC_NOT_FOUND);
} else {
// 403 for logged in user
response.sendError(HttpServletResponse.SC_FORBIDDEN);
}
}
}