Restrict AJAX calls to allowed functions only