not allowing non-ajax requests