Locating the source of Forbidden message
I started disabling modules one by one and rest_auth was actually causing it though it was  not being used. Simply disabling solved it. And yes it does not contain any word "forbidden".