Add ajax nonces

Prevents a "CSRF" attack, by checking that the action was intended and triggered via the actual admin link, and not a malicious link.
Example: `http://ninjaforms.dev/wordpress/wp-admin/admin-ajax.php?page=ninja-forms&action=ninja_forms_delete_form&form_id=2`

This should be applied to other ajax actions too.