removing insecure ajax-action