Return 200 http status code on 503 authz response

[phavekes]

This issue is imported from pivotal - Originaly created at Jun 13, 2022 by Michiel Kodde

Body communicates the 503 (forbidden) error. While the http status code should be 200. Maybe re-using the status codes for both constructions is somewhat confusing here.

Rationale: the HTTP response is not forbidden (hence the 200 code) but the application authorization check resulted in a forbidden status code.

HTTP requests and application logic should be seen as being on separate layers. And should not intermingle like we do now.