AJAX-era security requires tossing out a lot of what you thought you knew about security, starting with Same Origin Policy.

$.ajax({ data: criteria, datatype: "application/json", type: "POST", url: "MI/DeleteItem/" + ItemID, cache: false, success: function (result) {... You've seen these URLs in sample code that I've ...