One way to do this is to create a variable in another script or location so that the user sees only the variable name.
Also send the request via the post method and make the ajax server response page respond only to the POST request (say, using some server-side language such as PHP, ASP.Net or JSP). Thus, even if the user finds out the path to the URL, he will not be able to view its contents.