Using hook_menu() and hook_permission() to control access
Quick and dirty, you could do something like this:

function YOURMODULE_menu() {

  $items=array();

  $items['YOURMODULE/register/ajax'] = array(
    'page callback' =&gt; 'YOURMODULE_register_ajax',
    'access callback' =&gt; 'YOURMODULE_access_ajax',
    'type' =&gt; MENU_CALLBACK,
  );

  // other $items here...

}


and then define you own access function for ajax like this:

function YOURMODULE_access_ajax() {

  if (user_is_logged_in() &amp;&amp; $_SERVER['REQUEST_METHOD']=='POST') {
    return TRUE;
  } else {
    return FALSE;
  }

}


which will grant access to the path only if the user is logged in and is using POST to access it.  The key here is when you surf around, you are using GET, but when using AJAX, most of the time at least, you are using POST.  Now, if you wanted to get more fancy other than just if the user is logged in, you could do more with user_access() in there instead of the simple user_is_logged_in().

IF however, you are using GET for your AJAX, you can in your page callback check the parameters and if they don't validate, return MENU_NOT_FOUND; or return MENU_ACCESS_DENIED; instead of the drupal_json() stuff.