Better #on_access_denied handling, added callback for restricted /user routes