handler unauthenticated -> 403 + more tests