Add nonce & permission check, escape issue suggested by @westonruter and replace exit with wp_send_json methods #278 #251