Bug fix： AccessControlFilter and InboxService didn't check user's
authorization.
Feature: Add login-redirect.js to handle 401 error in one place.