Ajax router doesn't validate class/method exist; unused allowlist

The endpoint router doesn't verify the target class or method exists and keeps an unused allowlist.

Ajax.php:12