You are raising 404 error if the user is not authenticated. Wouldn't it be better to raise a 403 for example? I understand the 404 if the call is not AJAX (someone accessing through a web browser should not see that the page exists), but a 403 would make more sense for an AJAX call that gets rejected if the user is not authenticated.