Why do I get a 403 error?
Finally got it. It was mod_security indeed. I could not see errors in my (cpanel) log because I am on a shared host but went ssh and saw it:  

UNSUPPORTED DELAYED Rules: POST request must have a Content-Length header  

$header-&gt;header('Content-Type' =&gt; 'application/x-www-form-urlencoded', 'Content-Length' =&gt; 0, 'X-CSRF-Token' =&gt; $token);


That did the trick

Thank you Molot and David for taking the time to respond