Respond with 403 instead of 401 on authn failure