server: update codebase with proper http codes

several instances of StatusUnauthorized should really be StatusForbidden