By chance - why are you wanting to use FORBIDDEN. That isn't really what you want is it? If the survey is supposed to happen and the user hasn't reached it by error you probably should return a 400 level error succh as FORBIDDEN (403). I would say in your handler that you should either handle it right there in your method and return OK, or do an internal redirect which should then return OK. Or at the very least do a custom response REDIRECT (302) and bounce to another page, or custom reponse 200 and be done.
If they aren't really forbidden I wouldn't tell them they are. (Interesting on why it is popping up a 401 style Auth box though - maybe a stray .htauth file somewhere?)