Update action.php

fix bug that only allows admins any AJAX calls
Merge pull request #519 from jgpcx/patch-1

Update action.php