I have further information the to 403 error. internal_error.log states:

"2016/03/16 12:05:00 [error] 20579#0: *105 directory index of "/var/vcap/store/shared/" is forbidden, client: 10.10.0.104, server: blobstore.service.cf.internal, request: "GET / HTTP/1.1", host: "blobstore.service.cf.internal""

where the 10.10.0.104 is the ip of my api_z1 machine running the cloud_controller job. So this seems to be the cause of the 403 errors... any ideas?
Directory "/var/vcap/store/shared/" has owner "vcap:vcap" and the nginx worker processes are running as user vcap too.