api: request for tenant token without valid access returns 403 Forbidden

Signed-off-by: Jakub Koudelka <koudelka.j@gmail.com>