Return proper forbidden response status (403) instead of redirecting
If user not authenticated, she doesn't have permission anyways