Route all AJAX calls through wp-ajax.php

Also made sure the query is sanitized, removed including wp-load.php (since the AJAX is going through WordPress anyway), etc.