Fix auth redirect - use basic 'permission denied' page