Ajax endpoints not authenticated