src/main/java/js/servlet/AppServlet.java
protected static void sendUnauthorized(RequestContext context) {
		final ContainerSPI container = context.getContainer();
		final HttpServletResponse httpResponse = context.getResponse();

		if (httpResponse.isCommitted()) {
			log.fatal("Abort HTTP transaction. Attempt to send reponse after response already commited.");
			return;
		}
		log.error("Reject unauthorized request for private resource or service: |%s|.", context.getRequestURI());

		String loginPage = container.getLoginPage();
		if (HttpHeader.isXHR(context.getRequest()) && loginPage != null) {
			// XMLHttpRequest specs mandates that redirection codes to be performed transparently by user agent
			// this means redirect from server does not reach script counterpart
			// as workaround uses 200 OK and X-JSLIB-Location extension header
			log.trace("Send X-JSLIB-Location |%s| for rejected XHR request: |%s|", container.getLoginPage(), context.getRequestURI());
			httpResponse.setStatus(HttpServletResponse.SC_OK);
			httpResponse.setHeader(HttpHeader.X_HEADER_LOCATION, container.getLoginPage());
			return;
		}

		log.trace("Send WWW-Authenticate |Basic realm=%s| for rejected request: |%s|", container.getLoginRealm(), context.getRequestURI());
		httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
		httpResponse.setHeader(HttpHeader.WWW_AUTHENTICATE, String.format("Basic realm=%s", container.getLoginRealm()));
	}
protected static void sendUnauthorized(RequestContext context) {
		final ContainerSPI container = context.getContainer();
		final HttpServletResponse httpResponse = context.getResponse();

		if (httpResponse.isCommitted()) {
			log.fatal("Abort HTTP transaction. Attempt to send reponse after response already commited.");
			return;
		}
		log.error("Reject unauthorized request for private resource or service: |%s|.", context.getRequestURI());

		String loginPage = container.getLoginPage();
		if (HttpHeader.isXHR(context.getRequest()) && loginPage != null) {
			// XMLHttpRequest specs mandates that redirection codes to be performed transparently by user agent
			// this means redirect from server does not reach script counterpart
			// as workaround uses 200 OK and X-JSLIB-Location extension header
			log.trace("Send X-JSLIB-Location |%s| for rejected XHR request: |%s|", container.getLoginPage(), context.getRequestURI());
			httpResponse.setStatus(HttpServletResponse.SC_OK);
			httpResponse.setHeader(HttpHeader.X_HEADER_LOCATION, container.getLoginPage());
			return;
		}

		log.trace("Send WWW-Authenticate |Basic realm=%s| for rejected request: |%s|", container.getLoginRealm(), context.getRequestURI());
		httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
		httpResponse.setHeader(HttpHeader.WWW_AUTHENTICATE, String.format("Basic realm=%s", container.getLoginRealm()));
	}
Send unauthorized access response. This method send back a response with status code
{@link HttpServletResponse#SC_UNAUTHORIZED} and response header {@link HttpHeader#WWW_AUTHENTICATE} set to basic
authentication method and {@link ContainerSPI#getLoginRealm()} authentication realm.
<p>
If request is from an agent using XHR this method behaves a little different. XHR specification mandates that
unauthorized access to be handled transparently by client agent that usually displays client agent login form, not very
well integrated with application. Below is a snippet from this framework script library.
<p>
For not authorized XHR requests this method sends {@link HttpServletResponse#SC_OK} and custom response header
{@link HttpHeader#X_HEADER_LOCATION} set to application login page, see {@link ContainerSPI#getLoginPage()}. Client
script can handle this response and redirect to given login page.

<pre>
var redirect = this._request.getResponseHeader(&quot;X-JSLIB-Location&quot;);
if (redirect) {
WinMain.assign(redirect);
}
</pre>
<p>
Anyway, if application is not configured with login page, for rejected XHR requests this method still uses standard
{@link HttpServletResponse#SC_UNAUTHORIZED}.

@param context current request context.