def forbidden_challenge_decider(environ, status, headers): # pylint: disable=W0613
    """
    Newer pyramid versions return 403 instead of 401 when a forbidden view
    is accessed. This prevents the standard
    `repoze.who.classifiers:default_request_classifier` from doing the right
    thing and a challenge is never triggered.
    """
    return status.startswith('403 ')