We need a capability check for this AJAX callback.