[eluser]Tim Post[/eluser]
I think you have the basics of it down. You do need to check to make sure:
- It is an AJAX request
- The user has the right to do it
I'd also really consider turning on the built in XSRF protection. Additionally, (nitpicking), it's generally nice to set the HTTP status code appropriately when returning the response. A 200 when something bad happened isn't really consistent. It doesn't really matter in this particular case, but it's a nice habit to get into.