tests: `UserForbiddenError` instead of `NotAuthorized` #6

(now tested locally, should be green)