I just stumbled upon the comment in ForcePasswordChangeEventSubscriber that mentions the current method of sniffing header being imperfect. Also in https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Core%21EventSubs... one can find the implementation core uses for detecting if a request is an ajax request.
Since it's a simple change let's improve this here.
Not applicable.
Use the same technique as core does.
Create a merge request with the changes.
None.
None.
None.