Somewhere in the docs, perhaps in the information section, it may be worth mentioning that a User-Agent header is required. I was stuck for a while as I kept getting a 403 despite auth not being required. Eventually I discovered that I was not providing a user-agent and that was why I was receiving a 403.