mostly the nonces for ajax requests