f5 Access Policy Manager AJAX vs Non-Ajax Request Handling with Authentication

I'm wondering how in the first place the application manages to passes the policy without 302 support.

Assuming it's not even able do to that because of this(so not a problem of session timeout) you may want to consider the client less mode. If session cookies are not send in the following requests, APM will create a new session for each HTTP request.

when HTTP_REQUEST {
    HTTP::header insert "clientless-mode" 1
}