If you're logged in via a session on the website, just hitting the API endpoint isn't in your browser won't work. It won't be checking the session to see if you're logged in, it will be looking for an API token with the request. Since you aren't specifying a token, this throws an AuthenticationException.
The exception handler then takes this exception, checks your request and sees that it hasn't specified in the headers that it expects JSON. If it was expecting JSON, you would see a JSON response saying unauthenticated. Since it isn't expecting JSON, it redirects to the login page, which redirects to /home since you are logged in via a session. Confusing, but I expect that's the reason.
You'll need to use a tool like Postman if you want to play with your API endpoints so you can specify the required headers in the request.