I stand to be corrected and far from sure on this but I think strictly speaking, a "/" is asking for a directory. As such, depending on the server set up I would suggest that perhaps when you get the 403, it does mean 403 (not wrongly suggesting 404) as listing of the directory is denied. If you deleted the "/" and got a 404, that may be in order because it is looking for a page that could not be found.