added restriction for ajax url