feat: serve isolated companies below a fixed product path

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

vergabe_teilnahme/apps/accounts/middleware.py

@@ -1,6 +1,7 @@
 from django.contrib.auth.middleware import LoginRequiredMiddleware
 from django.contrib.auth.views import redirect_to_login
 from django.http import HttpResponse
+from django.urls import reverse
 from django.utils.cache import add_never_cache_headers
 
 
@@ -10,12 +11,12 @@ class PilotLoginRequiredMiddleware(LoginRequiredMiddleware):
     def handle_no_permission(self, request, view_func):
         if request.headers.get('HX-Request') == 'true':
             # The original URL may render only a fragment or accept only POST.
-            login = redirect_to_login('/', self.get_login_url(view_func))
+            login = redirect_to_login(reverse('home'), self.get_login_url(view_func))
             return HttpResponse(status=401, headers={'HX-Redirect': login.url})
         return super().handle_no_permission(request, view_func)
 
     def process_response(self, request, response):
         # Company records and account pages must not survive in shared caches.
-        if request.path != '/health/':
+        if request.path_info != '/health/':
             add_never_cache_headers(response)
         return response