ACL violations should return 403 and not hang server

[electronicmax]

steps to reproduce:

create a box with one user
give read access control to second user
open box with second user
try to save/write to box with second user
=> no http response is ever heard

should return 409 or something instead.