use head :forbidden rather than throw

This actually gives us the right HTTP error code.