adding missing test for 403 response