added security and ajax