auth.requires_login() and ajax - don't force just 401, thanks Anthony