added 403 Forbidden HTTP method to controller documentation