fix default config
Don't use the status code of 401 as that is specifically used when sending a challenge to the client, 403 is better suited where the request reaches the resource but we still choose not to fulfil the request.