Update action.php

fix bug that only allows admins any AJAX calls