That's true but not an argument for 403 over 400. Certainly either works. But one is more correct.