quick fixes: add privileged ajax actions, unslash json before responding