Add test cases for top level wildcards

Just to ensure it works.
Return a 403 Forbidden error page rather than 404