fixed ajax requests and changed api controller security