Right now the IP white/black list policies either pass or return a 500 error. Instead they should return a 403 (or possibly a 404). Could also be an option in the config of the policy.