today, apiserver generates an internal server error for any call
to mutatingwebhook if it gives allowed=false. this is not right as
it is really not an intenal error, it can be a forbidden as well
if the webhook wants it to be.
Kubernetes-commit: c2fcdc818be1441dd788cae22648c04b1650d3af