Our story so far: My Rails application's JQGrid's POST requests were running afoul of the OpenID mechanism, as if the browser session didn't belong to this user, or they hadn't authenticated with their OpenID Identity Provider. (You'll know if you're having the same problem if the last thing the browser sees is a 401 error.)

Basically, Sante at the OpenID Code list pointed me to the forgery-protection mechanism in Rails as the culprit. Sure enough, when I turned that off it worked. Of course you can't just leave it off, but I found a very nice fix at http://henrik.nyh.se/2008/05/r.....nbsp;which adds a handler for the ajaxSend event, ensuring that the Rails authenticity token is included with each and every Ajax request. One line in one file, seven in another, problem solved. Oh happy day! Thanks Sante and Henrik!