Only allow XmlHttpRequests access /exam/check.json