Changed session check to return 403 instead of 401 when identity is not found by cookie