I fixed this problem by switching to a different way of attaching the header (as required for older versions of jQuery):
'Authorization': "Basic " + btoa(window.localStorage.username + ":" + window.localStorage.password)
This does seem like a bug in the simulator. Is the deployed app running a different version of jQuery than the simulator does? And if so, why?, or more importantly: how can I tell?