Is there a way to validate that an ajax call your making from the profile is actually comming from a myspace profile and validate whos profile its coming from? 

Well, if you're using OpenSocial's MakeRequest function, you can set it's Authentication to Signed, which OAuth-signs the outgoing request, and also adds opensocial_viewer_id and opensocial_owner_id parameters so that you know whose profile (owner) it's coming from, and who is looking at the profile at that time (viewer).

 Exactly - please use SIGNED makeRequest() calls. There's

Thanks Jeremy for the post.

 Chak