GET /items/:collection/:id gives 403 error for invalid id instead of 404 #10137