We should return Handler error (access forbidden for example) as JSON for API.

This can be useful for OAuth2 Handler (see #1146 (closed))