Yes, I guess that AJAX request is sending that header but it shouldn't. Are you using custom JavaScript or some library like jQuery to send the AJAX request?
Try seeing if you can disable that header. Alternatively you can also try this class that does not send that header.
jsclasses.org/package/353-JavaScrip ...