Gah, browser bugs
After an hour of debugging I tracked down a bug due to how Firefox handles Ajax calls.
All Ajax calls generally come with a X-Requested-With: XMLHttpRequest header to indicate that a call is an Ajax call.
If the response of the call is a 302 (redirect), then browsers will make an additional call to the new URL but in FireFox, this second call does not contain the X-Requested-With header.