Fix request.path_info bug, return 403 if logged in