Forbid non-alphanumeric tags

They were already forbidden, but I was returning HTTP 400, whereas I
think HTTP 403 is more appropriate.