Return 403 error instead of 404 for permissions errors