[development] Change URL on ajax call, but enforce access checks?

[Moshe Weitzman]

arg() checking is discouraged in modern drupal for this very reason.
each drupal release we have been able to get rid of more of them in
core and with the D6 menu system, I really doubt we need any of these
calls to arg(). contrib modules that use arg() for access control
should refactor and let the menu system handle access control.

your workaround looks fine if it works and has no side effects. needs testing.