solved security, added ajax