Adds spec for disabled REST API
Sends 403 if API login disabled