browse: return forbidden (403) only when it is a permission error.

middleware/browse/browse.go

@@ -99,8 +99,11 @@ func (b Browse) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error) {
 		// Load directory contents
 		file, err := os.Open(b.Root + r.URL.Path)
 		if err != nil {
+			if os.IsPermission(err) {
 				return http.StatusForbidden, err
 			}
+			return http.StatusNotFound, err
+		}
 		defer file.Close()
 
 		files, err := file.Readdir(-1)