Merge remote-tracking branch 'upstream/pull/5245'

diff --combined app/controllers/api_controller.rb
index 84398ad617ac8299849b68e464f5aa568eec3b51,6ce8a0ef2d18045309e36784db5cb07d0f53483e..17c98fe8b657e4c52acf6133084a786110405d90
--- 1/app/controllers/api_controller.rb
--- 2/app/controllers/api_controller.rb
+++ b/app/controllers/api_controller.rb
@@@ -3,6 -3,8 +3,8 @@@ class ApiController < ApplicationContro
  
    before_action :check_api_readable
  
+   around_action :api_call_handle_error, :api_call_timeout
+ 
    private
  
    ##
@@@ -132,7 -134,7 +134,7 @@@
      report_error message, :bad_request
    rescue OSM::APIError => e
      report_error e.message, e.status
-   rescue AbstractController::ActionNotFound => e
+   rescue AbstractController::ActionNotFound, CanCan::AccessDenied => e
      raise
    rescue StandardError => e
      logger.info("API threw unexpected #{e.class} exception: #{e.message}")
@@@ -142,8 -144,8 +144,8 @@@
  
    ##
    # wrap an api call in a timeout
 -  def api_call_timeout(&block)
 -    Timeout.timeout(Settings.api_timeout, &block)
 +  def api_call_timeout(&)
 +    Timeout.timeout(Settings.api_timeout, &)
    rescue ActionView::Template::Error => e
      e = e.cause