Looking closer, this happens on the following action:
http://localhost/admin/api/content/GetMenu?id=69&languageid=2&issite=false&menuType=
The result is a 500 error with this information:
This request has been blocked because sensitive information could be disclosed to third party web sites when this is used in a GET request. To allow GET requests, set JsonRequestBehavior to AllowGet.
Any hints?