Throw 403 for ToU exceptions

If a user must sign the terms of use, the status code should be 403, not 401