Interface RequireAuthOptions

Where an unauthenticated browser navigation is sent: a same-origin absolute path, refused when the guard is built otherwise. A GET or HEAD that is not X-Requested-With: XMLHttpRequest, and that carries Sec-Fetch-Mode: navigate (or, without that header, an Accept naming text/html or application/xhtml+xml), is answered 302 here with a returnTo query parameter holding the requested path. Every other request keeps the 401 Problem Details answer. A request for this page's own path is always answered 401, so a guarded sign-in page cannot loop.