AJAX-era security requires tossing out a lot of what you thought you knew about security, starting with Same Origin Policy.

Use JSON for AJAX App Data As you might expect, Crockford called JSON the best data format for AJAX apps -- safe and effective, but "like everything else, dangerous when used recklessly." For example, ...