It looks as if the anti-XSS stuff is indeed the culprit. From the OpenID Code users group, I already got the response quoted below.

And when I turn off “protect_from_forgery” in Rails, it goes through fine. So my question now becomes “how do I supply the correct header from my JQGrid POSTs?”

Have you checked for the anti cross site request forgery header in the ajax request?