Return a 403 (Forbidden) when authentication fails instead of just a 400.