restrict access only to ajax call to getcn.php