add ajax secret key for security