diff --git a/src/api.php b/src/api.php
index cb6a8aa..c540fac 100644
--- a/src/api.php
+++ b/src/api.php
@@ -200,6 +200,7 @@ function checkReadAccess(?int $listId = null)
         $id = $db->sq("SELECT id FROM {$db->prefix}lists WHERE id=? AND published=1", array($listId));
         if ($id) return;
     }
+    http_response_code(403);
     jsonExit( array('total'=>0, 'list'=>array(), 'denied'=>1) );
 }
 
diff --git a/src/init.php b/src/init.php
index c9339c2..f7c9c9e 100644
--- a/src/init.php
+++ b/src/init.php
@@ -51,10 +51,10 @@ date_default_timezone_set(Config::get('timezone'));
 
 //User can override language setting by cookies or query
 $forceLang = '';
-if( isset($_COOKIE['lang']) ) $forceLang = $_COOKIE['lang'];
-//else if ( isset($_GET['lang']) ) $forceLang = $_GET['lang'];
+if (isset($_COOKIE['lang'])) $forceLang = (string) $_COOKIE['lang'];
+//else if (isset($_GET['lang'])) $forceLang = (string) $_GET['lang'];
 
-if ( $forceLang != '' && preg_match("/^[a-z-]+$/i", $forceLang) ) {
+if ( $forceLang !== '' && preg_match("/^[a-z-]+$/i", $forceLang) ) {
     Config::set('lang', $forceLang); //TODO: special for demo, do not change config
 }