there is no point in sending 401 Unauthorized to a UAS that sent us a properly-formatted Authentication header with the expected username and nonce but an incorrect response (which indicates the shared secret does not match)... instead, let's send 403 Forbidden so that the UAS doesn't retry with the same authentication credentials repeatedly