Allow posting from anywhere, does not really open up any security issue as you could post to the script not using AJAX.