set response code correctly on forbidden access
set response code correctly for users