Prevents infinite redirects due to ACL misconfiguration

Addresses issues discussed in #503

I don't like the hardcoded `User` value for aro and changing the supplied $url to `/` but I don't see any other way to do it.  Don't see much value in making those configurable.

But, do we really need this? This is most likely caused due to ACL misconfiguration and the problem goes away once the configuration is corrected.

Also, any security considerations?