Return 403 instead of redirect for requests matching predicate

This allows browser-side JavaScript to detect when an AJAX request has
failed due to authentication failure.