Ajax requests no longer return the home page when they shouldn't [MJ-381]

This just deals with anonymous users - normal users accessing items owned by other users is covered by MJ-350 and MJ-361.

If an anonymous user triggers an ajax request for something they shouldn't, a 403 is returned and the page is redirected via javascript.

All tests pass with the exception of the qunit tests in MJ-399 and MJ-400.