Return 403 rather than 400 on validation error