fixes ajax call protection so it only works on valid requests to api/getX