replace 401 response with 403 code