AJAX request protection: invalid request