Lots of security work done.  Need to add changes for dealing with permission errors with ajax queries.