fixed bug - ask for auth after forbidden