(nit) error code for forbidden should be 403, not 400