app: return 403 in the addUnits handler when quota is exceeded

Related to #382.