Request with invalid user returns 403