ajax calls work #TODO xsecurity