IncidentAddPhase: redirect using incident, not authorised event