Since these pages are not accessed by normal users, except for url fiddling, it's fine to respond with a generic access denied.