Some ISPs have quite aggressive intrusion detection (mod_security rules) that can falsely identify Ajax calls as an attacker. These tripwires then block your site to protect other users on the same servers. You just get Error 406 ‘Not acceptable response’ back.
If this happens, contact your ISP and ask them to reset the trip.
In a fully operational production system this should not be a problem, but if you are doing significant testing trying to break into the system this can happen.