Fix os_private's denials when it thinks we are not in a vsite, let pinserver handle access when sites are pin protected