I want my controller to return the right HTTP response code when the user lacks permission to view a particular page.
Use this: response.setStatus(403).
response.setStatus(403)