Requesting REST-GET gives me 403 but works fine in DHC
Doomed, I am so stupid. Chrome had the admin cookie, FF had a simple user cookie. I forgot to permit the GET on the new endpoint in the user permissions!!!

So stupid. @Clive: Thanks a lot for your help and sorry for that waste of time.