return 403 for non-public file storage access