Return 403 instead of redirect for requests matching predicate

This allows browser-side JavaScript to detect when an AJAX request has
failed due to authentication failure.
Merge pull request #7 from noidi/status-403

Return 403 instead of redirect for requests matching predicate