Route all AJAX calls through wp-ajax.php.
Don't need to reload WordPress in the AJAX call since it's already using WordPress to handle it. Remove override of content-type.
Sanitize the search query.