tests: `UserForbiddenError` instead of `NotAuthorized` #5

(kind of giving up)