Fix url_for call in denied path