fix: unsubscribing responds with 'forbidden'