fixes #789 - Security Issue: API allows access to any folder of the PC running MediaBrowser
run all ajax through apiclient