changes to the user authentication

Web/app.py

@@ -453,7 +453,7 @@ PERMISSION_ACTION_ENDPOINTS = {
     'admin_reset_user_password': 'can_manage_users',
     'admin_update_user_permissions': 'can_manage_users',
     'admin_anonymize_names': 'can_manage_users',
-    'home_admin': 'can_manage_settings',
+    'home_admin': 'can_borrow',
     'upload_admin': 'can_insert',
     'library_admin': 'can_insert',
     'admin_borrowings': 'can_manage_settings',
@@ -824,13 +824,10 @@ def _action_access_allowed(permissions, action_key):
 def _permission_denied_fallback_endpoint(permissions, current_endpoint=None):
     username = session.get('username')
     is_admin_user = bool(username and us.check_admin(username))
-    admin_home_allowed = _page_access_allowed(permissions, 'home_admin') and _action_access_allowed(permissions, 'can_manage_settings')
 
     for candidate in ('my_borrowed_items', 'tutorial_page', 'notifications_view', 'impressum', 'home_admin'):
         if current_endpoint and candidate == current_endpoint:
             continue
-        if candidate == 'home_admin' and is_admin_user and not admin_home_allowed:
-            continue
         if _page_access_allowed(permissions, candidate):
             return candidate
     return 'logout'