only flag ajax if logged in