> sent to a page where they can log in, and after that should be redirected to the page they were originally trying to access (assuming, of course, that they're

> sent to a page where they can log in, and after that should be redirected to the page they were originally trying to access (assuming, of course, that they're authorized to do so). Smells like an information discolsure highway. I usually 404 all requests that hit "unauthorized" content.