wp_ajax_nopriv is required for non-role users apparently