bugfix #184: set right status for 403