we should log (or at least statsd log here maybe?)

fwiw, I'd like to log every forbidden response so we've got a chance of finding out where it came from