FIX: if isExactScheme() == false, don't compare schemes in self-redirect check
FIX: AuthControlException respond with 403 if not sending a 401