Use check_ajax_referer() and add AJAX nonce