acl plugin: move ajax.php to action.php

Fixes FS#2233

Is this still required?
```
        //close session
        session_write_close();
```