The user erred in attempting to access a forbidden resource, yes. The server was perfectly capable of providing it, but it refused. That’s how HTTP status codes work.