Use 403 instead of 401 for access forbidden

According to rfc2616 a response of 401 should always include
a WWW-Authenticate header with a challenge, and we're not
passing that out.

REF: http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html