fix all redirection in ajax and all render to keep response body empty

need to make sure that under HTTP API
- [ ] wrong login credential => 401 Unauthenticate
- [x] wrong programUrl => 404 NotFound
- [x] unallowed program for this user => 404 NotFound
- [ ] unallowed by ACL for this user's level=> 404 NotFound