A forbidden should throw a 403 and this makes it easier for me to do some automated testing.

First step of a somewhat testable user management. - I know, the JSON returns are in an ugly format but the JS expects it that way. So let's keep it that way until we have time to fix the JS in the future.