Clean up auth code and use 403 over 401 where appropriate.

As [this](http://stackoverflow.com/a/6937030/285374) answer explains,
we should only use 401 UNAUTHORIZED when the user is not logged in and
the situation is temporary. 403 FORBIDDEN should be used when the user
is logged in but doesn't have the correct permission.