Throw 403 instead of 500 when calling post_auth directly