what about 403 "forbidden" instead since the user is authorized but he/she is requesting sth. not allowed ? (the same for the other 3 conditions).