Add this: jQuery.support.cors = true;
It enables cross-site scripting in jQuery (introduced after 1.4x, I believe).
We were using a really old version of jQuery (1.3.2) and swapped it out for 1.6.1. Everything was working, except .ajax() calls. Adding the above line fixed the problem.