Thanks Brandon,
Problem solved 
I have installed a security plugin...
by default, it changes the .htaccess file, to disallow access/edit by hackers
(using vulnerable scripts or plugins to gain privilege to files on wordpress).
So... a very famous .htaccess rule goes like this:
Order Allow,Deny
Deny from all
<Files ~ "\.(css|jpe?g|png|ico|gif|js)$">
Allow from all
</Files>
This simply disallow access to all files, "except" files with the above extensions.
TubePress must adhere to same-origin policy ...
also you can't just add "php" to the extensions above as this will defeat the purpose of the htaccess itself!!
So, the solution that I came up with (not perfect but works fine so far)
is to add an exception for a specific "filename"
so the above code becomes like this:
Order Allow,Deny
Deny from all
<Files ~ "\.(css|jpe?g|png|ico|gif|js)$">
Allow from all
</Files>
<Files "ajaxEndpoint.php">
Allow from 127.0.0.1
</files>
This allow access form the domain, to that file only...
Not sure if there is a better solution? 
Would love to see if there is a rule to allow all files of Tubepress...
but for now, this allows that file only...
So, for the specific problem I mentioned in the original post, is no longer happening
(hopefully nothing else is broken)
I wonder if there is a more secure solution?
or may be allowing the whole TubePress folder to get the exception?
Thanks again 
Tamer