BUG: user access strange things, 403 on ajax notification/user