Dev ajax security question