return a plain HttpResponseForbidden for json views