If they want to resort to that, they're entirely within their rights to do so. I have no right to demand they serve me their content. However, I have every right to make a polite request, and to download the response they send to me. They, however, have no right to tell me what to do with that response. If they want to give me a content-free response (your 402), they can do that. But no one does (the closest is sites like Forbes which use JS to block the content if you're blocking ads; personally I just don't go to Forbes any more).