added forbidden for non-ajax requests