fixed ajax auth