Because the JSON request could be spoofed from any page - we need to always check the session key for any function which is returning privileged data, or changing any state.

We can add this by including the sesskey in every request from the ajax amd module, and checking it in lib/ajax/service.php.

The impact of this bug is very low at the moment, only because we do not expose any dangerous functions to AJAX yet. So we should fix it ASAP.