Rather than return a redirect on Auth Failure for AJAX requests, return
a 401 with a Json response body indicating session expiry