JD_Toims - 9:52 pm on Sep 20, 2013 (gmt 0)
1. What HTTP header should I return if not 200?
2. Would allowing Googlebot to crawl be ok? I don't think that's cloaking and I see many sites doing this. Or will it penalize me somehow?
I wouldn't for exactly the reason Lucy24 states about visitors finding the page in the results and not being able to access it. -- It may not have a *direct* ranking impact, but it could certainly have a negative impact on visitor behavior and the willingness of visitors to visit your site for future queries even if the page returned for the next search is wide-open for everyone.
Also, it's been stated on a number of occasions Googlebot should see exactly what a "normal visitor" sees when they visit. Since "normal visitors" are "Forbidden" from entering without an account then serving Googlebot [and even not-logged in visitors since they'll likely never notice it if you continue serving the same page and just change the header] the correct 403 Forbidden header is the way I think I would go.