Fix: only redirect to login page when access denied