title: Symfony: How to use the @Security annotation with ajax requests
body: <p>I'd like to use the @Security annotation for controller actions which should be called by ajax requests. Problem is, if I use "form_login" for the firewall in security.yml and the the action is called by a user who is not logged in, symfony intercepts the response and sends a 302 redirect to the configured login page. Since it's an ajax request, the 302 redirect does not make sense here. Is there a (simple) way to change the behaviour of "form_login" to not send a 302 redirect but send a 401 code back to the client (ajax)? I can find a lot of information on how to overwrite the AuthenticationSuccessHandler and AuthenticationFaliureHandler for $request->isXmlHttpRequest() like: 
  <a href="http://www.webtipblog.com/adding-an-ajax-login-form-to-a-symfony-project/" rel="nofollow">http://www.webtipblog.com/adding-an-ajax-login-form-to-a-symfony-project/</a></p>
  
  <p>But that's only one part of it, this way you can avoid getting redirects when a user submits the form. But what I would like to do is sending a 401 back to the client not only when he already tries to login, but also instead of redirecting the user to a login-form URL because of a @Security annotation or "access_control" configuration.</p>
  
  <p>How I can do it now:</p>
  
  <pre><code>class AjaxController extends Controller
  {
      /**
       * @Route("/ajax/task/save")
       */
      public function ajaxAction()
      {
          $user = $this-&gt;getUser();
          if (!$user) {
              // load login-form in JS code 
              return new JsonResponse(array('authenticated'=&gt; false), 401);
          }
  
          // do...
      }
  }
  </code></pre>
  
  <p>but what I'd like to do is:</p>
  
  <pre><code>class AjaxController extends Controller
  {
      /**
       * @Route("/ajax/task/save")
       * @Security("has_role('ROLE_USER')")
       */
      public function ajaxAction()
      {
          // do...
      }
  }
  </code></pre>
  
  <p>But this way I have to make sure that not a 302 redirecting to the login-form is send to the client but something like my JsonResponse from the previous example.</p>
  
  <p><strong>How can I do this?</strong></p>