Redirecting to not-allowed serves no useful purpose, it doesn't tell the user anyting useful or let them do anything about it.