added auth. protection to all ajax calls