added 403 headers for non-redirect-secure-areas