title: form-login-config and ajax requests
body: <p>I have setup my web.xml with a login page, however, I would like the server to return a 403 status for certain servlets that are used for async calls. </p>
  
  <p>Servlets requiring authentication are all mapped as /restricted/*</p>
  
  <p>I can only think of 2 options:</p>
  
  <ul>
  <li><p>mapping async servlets outside of "restricted" and checking for the roles in the servlets</p></li>
  <li><p>handling redirect to login page in servlets that forward to a page</p></li>
  </ul>
  
  <p>Is there any other way I can do this and whilst keeping access control consistent throughout?</p>