re-added missing check for logged_in / not_logged_in and has access on ajax requests. #258