Change context middleware so that whoami request is first in list

There is an implicit dependency in some views on this. This is bad
and should be fixed, but for now let's keep it that way.
Improve 'Forbidden' view so that site is always fetched even if a bad access token is used