If you can see this after publishing, the widget itself works fine and the 403 is specifically about the JavaScript in the real page, not a general block.