AccessControll cleaned up and supports now no_permissions and nologin. Controller and actions for this usecases can be set in the global.php. The default role can be set by calling AccessControll::setDefaultRole($role) also.
The AuthenticationController now redirects correctly.