[permission] [minor] moved 403 to handler.py