It's true that even if the user gets a "You do not have permission to access this page.", it will still showup in who's online as their current location, since it just registers the script name for what the user is currently doing.