Redirect rather than throwing 403 when access check fails for create and edit actions.

This avoids an error when switching firm.