Sometimes JavaScript will need to set user preferences, for example to remember whether the user likes certain things collapsed or expanded. To this end, I propose a new script:

.../lib/ajax/setuserpref.php?sesskey=XXXX&pref=[prefname]&value=[value]

To avoid security problems, this scrip will only process an update if you have previously called a PHP function

user_preference_allow_ajax_update($name, PARAM_XXX);

This sets $USER->ajax_updatable_user_prefs[$name] = PARAM_XXX;

and sesskey will only update user preferences where the appropriate key is set in the session, and it will clean the value as specified there before doing the update.