We should send a static message, e.g. "Access Denied" from `HttpStatusServerAccessDeniedHandler` instead of the exception message.