* Also moved the autoloader setup a bit up since we need it in initpaths
Otherwise this leads to an endless redirection in case of a CSRF exception. Also sets user expectation right.