ajax authentication, separate html and js