^
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($your_resource, CURLOPT_HTTPHEADER, $headers);
These variables are not defined, it should be $ch
As for forbidden, the response headers are same when viewed through browser. Check the url / you probably need to send some cookies /...