FIX: Return 403 for unauthorized user access instead of 401.