diff --git a/src/EventSubscriber/PasswordPolicyEventSubscriber.php b/src/EventSubscriber/PasswordPolicyEventSubscriber.php
index 3f5397c..ede115d 100644
--- a/src/EventSubscriber/PasswordPolicyEventSubscriber.php
+++ b/src/EventSubscriber/PasswordPolicyEventSubscriber.php
@@ -25,20 +25,17 @@ class PasswordPolicyEventSubscriber implements EventSubscriberInterface {
     if ($account->id() > 0) {
       /* @var $user \Drupal\user\UserInterface */
       $user = User::load($account->id());
-      $route_name = \Drupal::request()->attributes->get(RouteObjectInterface::ROUTE_NAME);
+      $request = \Drupal::request();
 
-      // system/ajax.
-      $ignored_routes = [
+      $route_name = $request->attributes->get(RouteObjectInterface::ROUTE_NAME);
+      $ignore_route = in_array($route_name, [
         'entity.user.edit_form',
         'system.ajax',
-        'system.entity_autocomplete',
-        'system.machine_name_transliterate',
-        'system.timezone',
         'user.logout',
-        'editor.image_dialog',
-        'webprofiler.toolbar',
-        'webprofiler.frontend.save',
-      ];
+        'admin_toolbar_tools.flush',
+      ]);
+
+      $is_ajax = $request->headers->get('X_REQUESTED_WITH') == 'XMLHttpRequest';
 
       $user_expired = FALSE;
       if ($user->get('field_password_expiration')->get(0)) {
@@ -49,7 +46,7 @@ class PasswordPolicyEventSubscriber implements EventSubscriberInterface {
       }
 
       // TODO - Consider excluding admins here.
-      if ($user_expired and !in_array($route_name, $ignored_routes)) {
+      if ($user_expired && !$ignore_route && !$is_ajax) {
         $url = new Url('entity.user.edit_form', ['user' => $user->id()]);
         $url = $url->setAbsolute(TRUE)->toString();
         $event->setResponse(new RedirectResponse($url));