I want my controller to return the right HTTP response code when the user lacks permission to view a particular page.
Using an ExceptionResolver is a great way to go, but if you just want this to be view-independent, you could certainly make a call to response.sendError(HttpServletResponse.SC_FORBIDDEN, "AdditionalInformationIfAvailable"); in your Controller.
ExceptionResolver
response.sendError(HttpServletResponse.SC_FORBIDDEN, "AdditionalInformationIfAvailable");