fixed redirect for restricted access