If you write a web form to allow people to compose a mail message and you intend to let them send the email once they are done... don't setup an Ajax method called "sendEmail" because... now you're asking for trouble. Especially if you are in a portlet and didn't extend security around the servlet that is servicing your JSON messages. Just not a great idea.