Fix redirect loop on attempts to access AA without authorization
Consolidate AccessDenied handling
Simplify AdminAbility