I'm currently having a problem with working with AJAX. Well not really a problem since I can pretty much do what I want to do. The only problem is my boss saying that the admin-ajax.php file is an admin file and he doesn't want any admin file in the public side of the website. So my question is is there any alternative ways without using this method to make ajax requests in Wordpress? Here's what I'm currently doing:

add_action('wp_ajax_nopriv_plug_token', array($this, 'plug_get_token'));

add_action('wp_ajax_plug_token', array($this, 'plug_get_token'));

public function plug_get_token(){
  return $token;

And under the wp_enqueue_scripts action hook I'm loading the file for processing ajax request:

        'ajaxurl' => admin_url('admin-ajax.php')

So I simply call it in my script like this:

jQuery.post(plug_public.ajaxurl, {'action' : 'plug_token'}, function(token){
   //do something with the token

My boss said something about moving the admin-ajax.php into a more public location and then call from there. Is there really a security concern when calling admin-ajax.php from its default location?