I would just reply to my own post, but it has not yet been moderated, so I'll put this in to save any would-be helpers some time.

Our story so far: My Rails application's JQGrid's POST requests were running afoul of the OpenID mechanism, as if the browser session didn't belong to this user, or they hadn't authenticated with their OpenID Identity Provider. (You'll know if you're having the same problem if the last thing the browser sees is a 401 error.)

Basically, Sante at the OpenID Code list pointed me to the forgery-protection mechanism in Rails as the culprit. Sure enough, when I turned that off it worked. Of course you can't just leave it off, but I found a very nice fix at http://henrik.nyh.se/2008/05/rails-authenticity-token-with-jquery