Various enhancements

This pull request contains two small enhancements and a modification of how permission is denied to the application when not logged in: now the application returns a 403 error. This makes it possible to handle this particular error in js, e.g. presenting a logging prompt when an AJAX call fails because the session has expired.