diff --git a/access.lua b/access.lua
index 2aeb26c..25a0631 100644
--- a/access.lua
+++ b/access.lua
@@ -318,10 +318,11 @@ end
 
 if longest_unprotected_match ~= ""
 and string.len(longest_unprotected_match) > string.len(longest_protected_match) then
-    if hlp.is_logged_in() and hlp.has_access() then
+    if hlp.is_logged_in() then
         serveYnhpanel()
-
-        hlp.set_headers()
+        if hlp.has_access() then
+            hlp.set_headers()
+        end
     end
     logger.debug(ngx.var.uri.." is in unprotected_urls")
     return hlp.pass()