Security note for index-ajax.php