refactored to build response in build_response.  Added HTTP error response for Forbidden.