login: status 403 for initial unauthorised redirects