Use a 401 unauthorized instead of a 403 forbidden when a user makes a request anywhere.