allow ajax requests to me