always return 403 to POST requests

- POST requests need to receive a 403 error code
- minor wording updates

bookwyrm/views/permission_denied.py

@@ -1,8 +1,15 @@
 """custom 403 handler to enable context processors"""
+
+from django.http import HttpResponse
 from django.template.response import TemplateResponse
 
+from .helpers import is_api_request
+
 
 def permission_denied(request, exception):  # pylint: disable=unused-argument
     """permission denied page"""
 
+    if request.method == "POST" or is_api_request(request):
+        return HttpResponse(status=403)
+
     return TemplateResponse(request, "403.html")