Render nothing with forbidden (403) status for js, json & xml requests

For web-service related request (JS, JSON, XML), the response should not `redirect_to`.
This PR make it such:
* For `js`, `json`, or `xml` requests, simply render nothing with the status of `403 - Forbidden`
* For `html` requests, the old behavior is retained