403 when request is unauthorized
403 when request is unauthorized

When there is no user found for a given request (when there is no bearer
token based through to stagecraft), we use an anonymous user who has no
permissions. This will cause stagecraft to generate a 403 response
rather than a 401.

alphagov/pp-smokey,alphagov/pp-smokey,alphagov/pp-smokey