When a user lacks deploy permissions on a remote repository, he'll see a 400 response rather than a 403. The artifactory.log shows:
2016-03-13 06:50:44,182 [http-nio-8080-exec-189] [ERROR] (o.a.a.n.r.NpmRemoteRepoHandler:362) Error while parsing the response of a remote npm JSON query on 'https://registry.npmjs.org/express': User anonymous is not permitted to deploy '.npm/express/package.json' into 'npm-remote-cache:.npm/express/package.json'.
That should be a 403, not a 400.
