f5 Access Policy Manager AJAX vs Non-Ajax Request Handling with Authentication

I just found this in the docs: https://devcentral.f5.com/wiki/iRules.ACCESS__session.ashx

when HTTP_REQUEST {
   set apm_cookie [HTTP::cookie value MRHSession]
   if { $apm_cookie != "" && ! [ACCESS::session exists $apm_cookie] } {
      HTTP::respond 401 WWW-Authenticate "Basic realm=\"www.example.com\""  
      return
   }
}

It looks like it's specifically checking every HTTP Request and if the session is not active it will respond with a 401 Unauthorized Response. I think this is what I'm looking for.