If the server part of the url in the address bar is different to the server part of the address you are calling via AJaX then security permissions kick in.
If you are loading the page initially using the IP address, then you should call the AJaX through that address.
If you are using localhost then the same should be used for the AJaX.
This may seem strange at first because they are essentially the same machine. The security settings don't know that localhost and your IP address are the same. Your IP address could change.