First off, test for webdirect using:
Get(SystemPlatform) = 4
What you use also detects for Custom Web Publishing.
Second, in FMS16, the URL format has changed from: webd#database, to webd/database. Make sure you are using the correct one for your FMS install.
The OnFirstWindowOpen script will not inherit variables from the URL, and also runs before the script from the URL is executed. Thus if you want to block users from accessing your system, you either have to disable auto-login under file options which will force a username/password box to appear; Or the result of your OnFirstWindowOpen script MUST isolate the nonuser into a screen where they have no access to anything until the URL script gets a chance to run and validate.
We found that FMS15 also allowed the "/" instead of "#":
Chapter 3, page 28 of the FMS 15 Web Direct guide, under the "Linking to a database from an HTML page", in the "Keep these points in mind".
But worth a check if you upgraded and did not use the "/".