Thankfully, this was fixed in mere minutes last night. The "forbidden" symptom was a brief (~8 minute) stage as the server restarted. And this is fixed, so the "forbidden" error (most likely) won't be seen the next time the server has to be restarted.