added permission for ajax calls