title: Browser handling on 401 status
body: <p>I been working on an application that  basically interaction with the server over json api (Not CORS request mind you just plain ajax request to server with accepting a json format back)</p>
  <p>Now I have this feature where I need to logout a user if his/her token/session expired and way I handle this I render <strong>401</strong> status in the response header if that happen ever(token/ session expired)</p>
  <p>Now what I not able to understand is that I render <strong>401</strong> status I sort of get redirected to the current location</p>
  <p><code>http://localhost:4005/payouts</code></p>
  <p>On Chrome Network Header I see this</p>
  <p><a href="https://www.dropbox.com/s/vxv9ih0s0r7vumy/Screenshot%202014-01-16%2018.04.46.png" rel="nofollow noreferrer">https://www.dropbox.com/s/vxv9ih0s0r7vumy/Screenshot%202014-01-16%2018.04.46.png</a></p>
  <p><strong>Caution: Provisional headers are shown</strong></p>
  <p>At first I look to me that its chrome specify thing but I see the same thing happening in Firefox as well</p>
  <p>Is that a standard behavior I even went through documentation(<a href="https://www.rfc-editor.org/rfc/rfc2616#page-66" rel="nofollow noreferrer">RFC</a>) of how  the web browser handle <strong>401</strong> status code and to be honest I cant find any where mentioning of the fact the they happen to redirection if certain challenge aren't met</p>
  <p>Just Couple thing more request is</p>
  <ol>
  <li>Ajax Request + JSON Request (Not a <code>CORS</code> request)</li>
  <li>Below are my <code>Request / Response</code> Header</li>
  </ol>
  <p><strong>Request Header</strong></p>
  <pre><code>Request URL:http://localhost:4005/payouts/mark_as_paid.json
  Request Method:GET
  Status Code:401 Unauthorized
  Request Headersview source
  Accept:application/json, text/javascript, */*; q=0.01
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:en-GB,en-US;q=0.8,en;q=0.6
  Connection:keep-alive
  Content-Length:1709
  Content-Type:application/x-www-form-urlencoded; charset=UTF-8
  Cookie:_minerva_session=BAh7CUkiD3Nlc3Npb25faWQGOgZFRkkiJWI2N2MyNDg5MTg5YjEzNmM2MGM2ZDM2MTNlYWEyNzc3BjsAVEkiEF9jc3JmX3Rva2VuBjsARkkiMVN3b3JvVTJCZzFkaU1xOWhKeTU0c2hPT2F6dVZzOEhvdStMWml1QUNQUW89BjsARkkiEWFjY2Vzc190b2tlbgY7AEZJIkVlMGVmODM3OGMxZDBlYTRmNGFiYTRhMzcyZGFkMGZiYzBlYTI5NGNkODYxOTRhOTk1NTYwYTA0MzliYTgyY2JmBjsAVEkiHHdhcmRlbi51c2VyLmRlZmF1bHQua2V5BjsAVFsHSSIJVXNlcgY7AEZACw%3D%3D--93e6c7c38e4798ca3a1fbe15485a22eba3f358a9
  Host:localhost:4005
  Origin:http://localhost:4005
  Referer:http://localhost:4005/payouts
  User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36
  X-Requested-With:XMLHttpRequest
  </code></pre>
  <p><strong>Response Headers</strong></p>
  <pre><code>Cache-Control:no-cache
  Connection:close
  Content-Type:application/json; charset=utf-8
  Server:thin 1.6.1 codename Death Proof
  Set-Cookie:_minerva_session=BAh7CEkiD3Nlc3Npb25faWQGOgZFRkkiJWI2N2MyNDg5MTg5YjEzNmM2MGM2ZDM2MTNlYWEyNzc3BjsAVEkiEF9jc3JmX3Rva2VuBjsARkkiMVN3b3JvVTJCZzFkaU1xOWhKeTU0c2hPT2F6dVZzOEhvdStMWml1QUNQUW89BjsARkkiCmZsYXNoBjsARm86JUFjdGlvbkRpc3BhdGNoOjpGbGFzaDo6Rmxhc2hIYXNoCToKQHVzZWRvOghTZXQGOgpAaGFzaHsAOgxAY2xvc2VkRjoNQGZsYXNoZXN7BjoKYWxlcnRJIhNUb2tlbiBleHBpcmVkIQY7AFQ6CUBub3cw--a09dddd474e1201fec156c47d298e3189b6a4451; path=/; HttpOnly
  X-Request-Id:be146be842651831d3903ab0db99bc5e
  X-Runtime:0.016927
  X-UA-Compatible:IE=Edge
  </code></pre>
  <p><strong>JSON Response Data</strong></p>
  <pre><code>{&quot;error&quot;:&quot;Token expired!&quot;}
  </code></pre>