Check that user has 'edit_theme_options' capability on AJAX endpoints

Also alter ajax_header_remove() and ajax_header_add() to use
ajax_check_permission()

@mcsf - does this look OK?