It seems that some users had to clear cookies (and maybe html5 localstorage) to get pass the Forbidden error, even after it was fixed for me. When I was having the problem initially, clearing cookies didn't seem to help, but at least one form of the error is due to having outdated cookies. This may have been caused by changing the secret key in config.json.
