In order to speed up debugging / development I tried the request in curl:
$ curl -D /dev/stdout 'http://example.test/search/ajax/suggest/?q=aaa'
This always returns an empty array. But in the browser it works. Two questions:
1) Where: I can only guess my request missing a session cookie that prevents the search. Where is that coded?
2) Why: Any educated guesses why this has been done and possibly how to turn it off?