should there be a test for 403 and (as per docs 409)?