Add todo for doing nonce and cap checks in Ajax callback