403 responses are now used instead of 401