some absent security checks added to reconcile ajax