This changeset fixes the bug with AJAX requests that hit an expired session. The following modifications have been made:
1) a separate Spring Security realm (<http> tag) for AJAX URIs
2) the basic HTTP authentication for these URIs (401 response with no "WWW-Authenticate" HTTP header to avoid credentials dialog in the browser)
3) on the client-side, 401 AJAX responses are redirected to the "Session Expired" error page.