The only validation function I've written contains this:

    throw({forbidden: 'Only administrators can write changes'});

IIRC, it raises either a 401 or 403 HTTP error.