You are right, 403 is better.