added nonce to our ajax handler