bugfix, hash denial now works with either message or redirect_to