Set Forbidden rather than Unauthorized on authorization failure

Based on my reading of the http error codes, a Forbidden (403) error is more
appropriate than Unauthorized (401), as Forbidden states:
"Raise if the user doesn’t have the permission for the requested resource but was authenticated."

As bouncer does not deal with authentication, and a 401 is used when
authentication errors occur, it makes more sense to raise a 403, on the
assumption that authentication has been already dealt with by another
component.