403 Forbidden implies to me that you don't have permission to change this - i.e. you are authenticated but not authorized, need to be a super duper admin or something.  Seems like it would get confused with not being logged in.

A generic 400 Bad Request might be better.  Or a 422 Unprocessable Entity.  Do we have any conventions in existing code for these kinds of errors?