better defense against 403s on POST