Ajax validation + correct routes + permissions