Removed dead code.
Return a 403 in the appropriate case.
- If the user is authenticated but authorization fails
  return a 403.