#107 if request is not ajax then forbidden