Forbidden

A request the application understood and refuses: a form whose CSRF token is missing or stale (#170), a write to a row the current user does not own, or a guarded WebSocket handshake carrying no live sign in. #166's constraint: no status here, and a redirect to login is a Response, never an error.

The one refusal there is, rather than a 403 beside a 401, because eezo signs in through a form and a session cookie and has no honest challenge to put on a 401: the scheme token a 401 needs would be one eezo invented, and a client reading the status alone learns as little from that as from this. What kind of refusal it was is the detail's job. See docs/adr/0001-http-errors-live-in-http-and-carry-no-status.md.