HTTP 403 is more semantically correct for a disabled account