added security checks
using XAJAX as global object