sending a redirect on non auth request should  be based on the accept headers, not content-type