Create proper template for 403 messages

Create proper template for 403 messages

By using a real template, we both make permission denied messages look
better (properly rendered), and also makes it possible to tell the user
*why* access was denied.

This makes using PermissionDenied exceptions a lot more useful, so
update a number of places that were sending out access denied messages
as 404s.