Use 403 by default

- Use ``RATELIMIT_STATUS_CODE`` setting to override default status_code (which is now 403).
- Some testing to ensure that our custom HTTP codes are used when specified.