handle ajax request on privilege controller