CSRF Protection in AJAX post
As Robin Schambach suggested I looked through my stack trace.
The request was fine but php couldn't find the template used on ajax-requests due to a misspelling error.

Fixed the misspelling – works like a charm.