Return 403 forbidden by default

Re: #41
I haven't updated the CHANGELOG nor did I bump the version. If you want to merge this and release a new version right away, I can add it to the PR.