Add forbidden error.

Will be used in subsequent PRs that add authorization.