In reply to Aaron Jorbin.

@jorbin, since the message is emitted when user tries to access resource he has no permission to access, the message should never be displayed to any actual user, only to developers, unless the user actually tries to hack the site. But I guess milenial developers can not handle "your code is idiotic" type of message and it needs to be sugar coated for them.

I guess the right way is to just remove the message. 403 status exists to indicate exactly that, and since we are talking about security there is no reason to go into details about the why you got a 403.