One of these problems is easy to solve --- the ErrorDocument for 403
should be in a directory to which outside clients *do* have access.
It may be worth creating a directory for ErrorDocuments *only*, with
these (I guess, for the site) unusually permissive access controls,
so that the permissions on the ErrorDocuments don't leak onto other,
more sensitive stuff.
Or maybe I'm just fried...
rst