D 13211 fixing broken functionality

Adding back the ability for the ClientAuthZ filter to return a 403 FORBIDDEN during the 2 scenarios:

1. Authentication is delegated
2. User requested a service endpoint that is NOT in their list of authorized endpoints

Before this pull request, a change was made to address this defect which resulted in the above 2 scenarios returning a 500 response instead of the previously returned 403 response.