added a possibility to pass a forbiddenFallback function in order to handle redirect manually in app.js rather than always redirect to login