403 Forbidden instead of redirect to login.
Add settings permissions test.
Add 403 Forbidden template.