use nonces for all Ajax communication, handle them centrally in ajaxFactory