Handle Forbidden exception as unauthorized when no token is provided

There are cases where you can get to resources anonymously and others that cause 403 which should be manifested as 401. Modify the auth logic to throw an unauthorized if a 403 is returned and no token was provided for authentication