f5 Access Policy Manager AJAX vs Non-Ajax Request Handling with Authentication

..the user's session has expired, to respond with a 401 http response when the request has the header X-Requested-With: XMLHttpRequest.

when ACCESS_SESSION_STARTED { 
  if { [HTTP::header "X-Requested-With" ] equals "XMLHttpRequest" && [HTTP::header "Referer" ] contains "my.logout.php3" } {     
     ACCESS::respond 401 
  }   
}