Redirects have to be handled in a special way (e.g., returning the hx-redirect header if the hx-request header is provided in the request) because browsers will remove the location header and response code from ajax redirects. The default handling of response codes is wonkey but it can be fixed:
https://htmx.org/quirks/#by-default-4xx-5xx-responses-do-not-swap