[Flow] ajax update object get 403 error

[Rocky]

Hey,

I am trying to use ajax to update the Entity object. The endpoint of the ajax request is granted for users who has role "Editor".  The button which triggers the ajax call is show after the "Editor" is logged in. After I clicked the button, I got below error in Chrome's inspector panel:  

"POST http://flow-learn.local/my.package/object/update 403 (Forbidden)"

I think the ajax request does not carry the authentication information. Any help please?