FIX: auth unit tests for 403 status