Q2A has nothing to do with this issue and based only in the information you've shared, you don't seem to be doing anything wrong. I'd rather ask for help to your hosing provider.
You also haven't explained much about the issue. For example, when do you get the 403 error? Immediately after you save the settings? What does the web browser's console log and network tab display?
Anyway, if you get a 403 error you are not being able to access the URL you're POSTing to when saving, which happens to be the same URL you were accessing with a GET.
So you have seriously messed with your web server configuration (or your hosting company has) or maybe there is some kind of ridiculous security setting that won't allow you to POST JavaScript code.
BTW, I don't think GoogleAnalytics has anything to do with this and I'm pretty sure this code would also fail:
<script>alert('Hello');</script>
If it works then you should ask your hosting provider why they don't allow your pages to contain a link to GoogleAnalytics, which is obviously ridiculous.