public function preDispatch()
    {
        $this->_getHelper()->disableSessionForControllerAction('token', $this);

        parent::preDispatch();

        $this->_getHelper()->setIsEsiAllowed(false);
        $this->_getHelper()->setIsInternal(true);
        Mage::app()->setUseSessionVar(false);
        Mage::app()->setUseSessionInUrl(false);

        // Disallow any non AJAX requests to this url
        if (!$this->getRequest()->isXmlHttpRequest()) {
            $this->getResponse()->setHttpResponseCode(403);
            $this->getResponse()->setBody('Forbidden');
            $this->setFlag($this->getRequest()->getActionName(), self::FLAG_NO_DISPATCH, true);
        }

        return $this;
    }