minor bugfix and pbc settings

Access settings used the old REQUEST_URI server var instead of X_REQUEST_URI which circumvented the rewriting