correctly handle redirect to 403