HTTPForbidden seems more appropriate than HTTPUnauthorized
Put model instance in the schema to make some validations easy