Respond with 403 on session/authentication failure