accept HTTP 403 as well as 401 to mean 'unauthorized'