app: error handling: also `UserForbiddenError` instead of `NotAuthorized`