dir traversal protection for ajax.php

This file will go away soon, but some protection for now.