API now throws 403 Forbidden when cannot auth user