added secret protection to the HTTP/AJAX inteface