Use auth_ajax. Only authenticated users are allowed to determine the featured status
Remove old file