change ajax_referer to admin_referer to reinforce against CSRF