Restrict access to page passing params for Ajax Calls

[quantumlicht]

We don't want users to retrieve content of db if they know what ajax call to pass