code: protected Response handleSecurityError(Throwable exception, Throwable catched) {
  
      NlsRuntimeException error;
      if ((exception == catched) && (exception instanceof NlsRuntimeException)) {
        error = (NlsRuntimeException) exception;
      } else {
        error = new SecurityErrorUserException(catched);
      }
      LOG.error("Service failed due to security error", error);
      // NOTE: for security reasons we do not send any details about the error to the client!
      String message;
      String code = null;
      if (this.exposeInternalErrorDetails) {
        message = getExposedErrorDetails(error);
      } else {
        message = "forbidden";
      }
      return createResponse(Status.FORBIDDEN, message, code, error.getUuid(), null);
    }
docs: Exception handling for security exception.
  
  @param exception the exception to handle
  @param catched the original exception that was cached. Either same as {@code error} or a (child-)
  {@link Throwable#getCause() cause} of it.
  @return the response build from exception