View located in different default folder

Please try to disable csrf protection, so we know the cause of the problem.
app\config\config.php

PHP Code:

$config['csrf_protection'] = FALSE; 


If it's working, you will need to turn on csrf protection again and pass the csrf token and cookie name with your ajax request. There are plenty of solution for this problem, so a quick search on this forum will solve that.

Working if

PHP Code:

$config['csrf_protection'] = FALSE; 


Then talk me about it, because would security risk?

Thanks