The issue we found is that our web site can't capture the 401 error from Ajax call. I have the following code.
$.ajaxSetup({
beforeSend: function (xhr) {
var token = $('[name=__RequestVerificationToken]').val();
xhr.setRequestHeader('__RequestVerificationToken', token);
},
statusCode: {
401: function () {
--------------------------
}
}