Everything looks great with your action, and this is the recommended approach. Unfortunately, when authorization errors occur in roles or actions, the application must display the error to the user, not the universal login page. You can find more information in this FAQ (the FAQ refers to rules, but the same is true in post-login actions):