Correct docs: static_file returns a 403 on permission errors, not a 401