Send 403 status code when access is forbidden, not 200 - fixes #244