Gotcha.  So...two things.

1. I don't think we need that filter, in part because...
1. I don't think this filter should be private.  Everything (except perhaps ajaxurl) is intended to be accessed publicly and should be considered safe for modification from the filter.