For a mobile e-commerce site, that follows the client-server model, where all the views are json-ajax calls to return data from a secure service, is it safe to also pass the "checkout" process through an ajax call?
If the service only responds to the site (i.e. lockdown on the IP range) would that make it secure? Are there other considerations? Are there specific security holes to protect against in this setup?