Add ‘Not authorized’ notice to redirect

* Clean up set_user logic