Fixed 403 return code when is authenticated but doesn't have proper role

fixes #164.
Also added test on 403 to each REST API functional test. Thanks to this functional tests covers not authenticated scenario (401) and also authenticated user with not proper role e.g. `CONTRIBUTOR` (403).