Cron is 403: forbidden with cron_key and through 'run cron' link I'm getting a 403: You don't have permission to access /cron.php on this server.

This is whether or not I am logged in. Stranger thing is that it is happening on our development server, but not the live server (drupal 7)
If token is valid (and it should be when you use Drupal-generated link), there is one other mechanism that can generate 403: .htaccess - check it for rewrites that might block it. If this will not help, try running cron from Drush. Drush bypasses Apache altogether, so you can know if the problem was Apache related (conf files, .htaccess), or purely Drupal related.