#6 added test for forbidden response