[TYPO3-mvc] Ajax request (using PT_EXTBASE dispatcher) questions

[Philipp]

Hey, i dont know if this is the correct board for my following questions... anyway:

1) When doing repository requests with ajax my REPO does not respect the enablecolumns (deleted, hidden). Whats the problem here?
2) I think there is absolutely no accessprotection in the pt_extbase ajax dispatcher... is there a known way to handle this or do i have to place a kind-of routing file which defines the possible Controller-Action combinations?

Here is my ajax bootstrap:

use TYPO3\CMS\Core\Utility\GeneralUtility as Utility;
use TYPO3\CMS\Frontend as Frontend;

if (isset($_REQUEST['id'])) {
	$id = $_REQUEST['id'];
	$GLOBALS= Utility::makeInstance('TYPO3\\CMS\\Frontend\\Controller\\TypoScriptFrontendController',$TYPO3_CONF_VARS, $id);
	/* @var $GLOBALSFrontend\Controller\TypoScriptFrontendController */
	$GLOBALS['TSFE']->connectToDB();
	$GLOBALS['TSFE']->initFEuser();
	$GLOBALS['TSFE']->checkAlternativeIdMethods();
	$GLOBALS['TSFE']->clear_preview();
	$GLOBALS['TSFE']->determineId();
	$GLOBALS['TSFE']->initTemplate();
	$GLOBALS['TSFE']->getConfigArray();
} else {
	$GLOBALS= Utility::makeInstance('TYPO3\\CMS\\Frontend\\Controller\\TypoScriptFrontendController',$TYPO3_CONF_VARS,0,0,TRUE);
	$GLOBALS['TSFE']->sys_page = Utility::makeInstance('TYPO3\\CMS\\Frontend\\Page\\PageRepository');
	/* @var $GLOBALS['TSFE']->sysd_page Frontend\Page\PageRepository */
	$GLOBALS['TSFE']->initFEuser();
}

//Connect to database
Frontend\Utility\EidUtility::connectDB();

// Init TSFE for database access
//$dispatcher = t3lib_div::makeInstance('Tx_PtExtbase_Utility_AjaxDispatcher');
$dispatcher = Utility::makeInstance('Tx_PtExtbase_Utility_AjaxDispatcher');
/* @var $dispatcher Tx_PtExtbase_Utility_AjaxDispatcher */
$dispatcher->initCallArguments();
echo $dispatcher->dispatch();
?>