only Ajax request allowed.