I can't believe that we never implemented the forbidden (403) HTTP response code until today