FIX: Don't redirect XHR/JSON requests when login is required (#15093)

When redirecting to login, we store a destination_url cookie, which the user is then redirected to after login. We never want the user to be redirected to a JSON URL. Instead, we should return a 403 in these situations.

This should also be much less confusing for API consumers - a 403 is a better representation than a 302.

spec/requests/application_controller_spec.rb

@@ -120,6 +120,14 @@ RSpec.describe ApplicationController do
       expect(response.body).not_to include("data-authentication-data=")
       expect(response.headers["Set-Cookie"]).to include("authentication_data=;") # Delete cookie
     end
+
+    it "returns a 403 for json requests" do
+      get '/latest'
+      expect(response.status).to eq(302)
+
+      get '/latest.json'
+      expect(response.status).to eq(403)
+    end
   end
 
   describe '#redirect_to_second_factor_if_required' do