Do not redirect to to login_url for XMLHttpRequests

When using the web.authenticated decorator, it would be nice to not redirect to the login_url for unauthenticated XMLHttpRequests, but raise a 403 error instead. There is no foolproof way of detecting an XMLHttpRequest, but there seems to be some consensus amongst JS frameworks (mainly jQuery) to add the `X-Requested-With: XMLHttpRequest` header to same-origin requests.