links, security, and ajax