Security audit of ajax calls