Now that we have all api controllers inheriting from a common base, it's easier to override the deny_access handler without having to switch between both. Fixes #2064