Ok, the current behavior is just plain wrong - we're returning a 403 to a `HEAD` request, but a 200 to a `GET`.