[Nivec]

Eventually found the problem, I had to pass the security token as well:

'securitytoken': SECURITYTOKEN

So the post now looks like:

$.ajax({
	type: 'POST', url: './misc.php',
	data: { 'do': 'cloc',
	'action': 'updatevp',
	'X': X,
	'Y': Y,
               'securitytoken': SECURITYTOKEN}
})