send http 401 on "forbidden" pages, refs #910 and #911