Return 403 instead of 401, 401 is for HTTP authentication.