Additional parameters are passed to unauthorized handler after XHR fails