Fixes #829: loginRequired now responds with HTTP 403 in case of AJAX or loginUrl is not set

framework/yii/web/User.php

@@ -287,10 +287,8 @@ class User extends Component
 	public function loginRequired()
 	{
 		$request = Yii::$app->getRequest();
-		if (!$request->getIsAjax()) {
+		if ($this->loginUrl !== null && !$request->getIsAjax()) {
 			$this->setReturnUrl($request->getUrl());
-		}
-		if ($this->loginUrl !== null) {
 			Yii::$app->getResponse()->redirect($this->loginUrl)->send();
 			exit();
 		} else {