Fix redirect loop.

Of course we can not just redirect to the root on denied access, because we might come from there.