abort on error

logic/security.go

@@ -154,7 +154,8 @@ func SecurityCheck(reqAdmin bool, next http.Handler) http.HandlerFunc {
 		w.Header().Set("IS_GLOBAL_ACCESS", r.Header.Get("IS_GLOBAL_ACCESS"))
 		if err != nil {
 			w.Header().Set("ACCESS_PERM", err.Error())
-
+			ReturnErrorResponse(w, r, FormatError(err, "forbidden"))
+			return
 		}
 		r.Header.Set("user", username)
 		next.ServeHTTP(w, r)