Send ajax request through CURL
in chrome, you can copy a working curl expression from developer toolbar. Try with that one from cli. If that works, you can figure out which parts are required and which parts are not. Then you can transcript it to php.
If you have doubts if the same thing happens from php than from curl, just try it with requestbin.
I think it is possible the header for token may not be what you think it is, since given $a==1, '$a' converts to $a, but "$a" converts to "1" (notice single quotes vs double quotes).
in your example, try replacing:
'__RequestVerificationToken: $token'with:
"__RequestVerificationToken: $token"and let us know if that solves the problem.
Consider using passthru("curl command here..."); using the suggestion from lintabá