used ``bottle.request.is_xhr`` for ``check_user_for_ajax``