Ajax requests from front-end with jQuery Fancybox

&nonce should be ?nonce. The ? begins a query string, the & separates arguments within a query string.