Cleaned up lobby HTML/LESS, made ajax calls return HTTP 403 instead of index page when not logged in