Only ajax requests allowed