If the user doesn't have permission to access a page, it should return 403

#18