simplified ajax-with-nonce