Split the ajax in a no priv request and a standard request to differenciate between which methods are accessible via logged in users and which are only from the outside.