Should be a forbidden, not unprocessable entity