Ensure missing user returns 403 status