ajax protection and POST