When user not in WS allowed user group, should return 403 Forbidden instead of 500 Internal Server Error

When a user is not in the group set by ws.client.user.group.name, the response is 500 Internal Server Error. There isn't really an error, rather the user is forbidden. So the return code should be 403 Forbidden, so it can be distinguished from other kinds of errors.

(Commit a3bfcc44, affects Grouper 1.3+)