Added a \OCP\JSON::callCheck() on top of each AJAX script to prevent CSRF attacks