Move URL intercepting to end of security chain so access denied isn't
triggered until after auth is checked.