Return 403 instead of 404 when token is missing/invalid on box calls