prevent ddos vector in ajax saving