began JSON/AJAX handler
serve static admin files (insecurely)