f5 Access Policy Manager AJAX vs Non-Ajax Request Handling with Authentication

Will this iRule only hit when the session has expired or is invalid?

No, this will hit as long as the header matches. Assumption is the first time you hit APM you don't have this header. Again, I'm not sure how you want to handle the 401 response.

Create the irule - Local Traffic ›› iRules : iRule List ›› Create

Add to VS- Local Traffic ›› Virtual Servers : Virtual Server List ›› ›› iRule Manage