Added nonce check for the ajax calls.  Seems to be working just fine :-)