throw forbidden errors instead of server exceptions when requiring admin/mod without a session