ajax call security -- untested