ajax callback functions needs access check

Maybe it's hard to do this,but now it's un checked,so anyone can access all of the callbacks, that will
cause security issues.