Just answering my own question here… it was hitting a ModSec rule on the server that is in place to protect from a XSS vulnerability in a plugin called Modern Events Calendar Lite plugin 4.2.1 for WordPress – which I don’t use so server guys have disabled rule and it works now!
Hope this helps someone else sometime!
