restrict redirection to AccessDenied page