Only check DOING_AJAX

Not sure why, but some hosts are setting the HTTP_X_REQUESTED_WITH
header for seemingly non-ajax requests. Could be MT, could be cloud
flare, we don’t know.
Changelog bump for DOING_AJAX change