Currently when user has access violation on website we're redirecting him/her to the "no_permission" template. There are several side effects from this approach:
- user no longer sees url of the page which caused access violation
- the HTTP response code is now 200 instead of 401
Solution
Proposing to show "No Permission" page inline instead of redirecting to it.