[WIP] Make new authentication request more flexible and with Ajax request support

- [ ] Add specs
I think good to verify header.location as well in this case. I believe it is set.