Page disabled was overriding page auth

Page disabled was overriding page auth. So a 404 was being sent rather
than 403 with redirect.