return 403 response if we find auth cookie