Return 403 Forbidden instead of 401

401 Unauthorized suggests that the requests can be
retried with appropriate credentials. 403 explicitly
states that the request should not be repeated.

See #41
Update readme
Change response body to 'Forbidden'
Merge pull request #42 from carpodaster/feature/return-403-forbidden-by-default

Return 403 forbidden by default