<g:remoteFunction action="list" controller="todo" update="todo-ajax">

<div id ="todo-ajax">
//ajax call rendered in this area
</div>

HttpServletRequest.metaClass.isXhr = {->
         'XMLHttpRequest' == delegate.getHeader('X-Requested-With')
    }

if(request.xhr) { ... }

if(!request.xhr) {
    redirect(controller: 'auth', action: 'index')
    return false
}

import javax.servlet.http.HttpServletRequest

class BootStrap {

     def init = { servletContext ->

        HttpServletRequest.metaClass.isXhr = {->
            'XMLHttpRequest' == delegate.getHeader('X-Requested-With')
        }

     }
     def destroy = {
     }
}