More work on properly checking permissions with ajax requests.