Only check DOING_AJAX for AJAX requests

Not sure why, but some hosts are setting the HTTP_X_REQUESTED_WITH header for seemingly non-ajax requests. Could be MT, could be cloudflare, we don’t know.

I think is ready for the next maintenance release, @mikejolley?