Return 403 if no auth based on roles, fix #1382