Added middleware that raises 403 if XMLHttpRequest is attempted without being logged in
Make sure not to load main.js and some html when not logged in
Make sure urls in navigation start with #!
Change api_request to refresh page when forbidden error is returned