Add Forbidden403Exception
Open endpoint should call _open

Was previously calling _close, which is obviously the wrong behavior