Fix XSS issue

You could inject JS via the url callback:
/#noAccess?urlback="><script>alert(9)</script>