HTTP 403 is more accurate than 401 when it comes to authorization
errors. HTTP 401 should be reserved for authentication errors.