AJAX HTTP Error (with Result Code 403) "Forbidden" in replying to posted comment.

Stock OA 2.41 cleanly updated to OA 2.43 (Status Report is green, only a Warning related to Panelizer all field hidden, yet discussed here after an 2.41 to 2.42 update test, is still shown).

Cache Cleared, Permissions Rebuilt and drush fra -y executed.

I noticed something that on OA 2.41 didn't happen: Reply to a posted Comment generates an AJAX HTTP Error (403).

Don't know which queue to use I used Code.

Step to reproduce:

(0) use Mozilla Firefox 38.0.5 (I'm on Linux 64 bit), procedure not verified with other Web Browsers.
(1) suppose to have a Space with Comments enabled for various Content Types (Event/Discussions) and a Calendar/Discussion Section.
(2) create an Event/Post.
(3) users (not Site Admnistrator), inherited (from Groups) into the Space, are able to post their Comments on Event/Post. That's expected.
(4) users aren't able to Reply to their own Comment previously posted.
(5) users aren't able to Reply to any Comment previously posted by other users.

Site Administrator is able to post Reply to Comments without any AJAX HTTP Error (403).

Procedure above can be reproduced by any authenticated user inherited member of the Space, no matter if those users are members of their same Group or if they belongs to other Groups, all Group used are inherited in the same Space (permissions are set as @mpotter instructed and Drupal role Editor was not used).
I didn't tested with direct Space members. Tested also with direct Space members: the AJAX HTTP Error persist.

Logs:
HTTP Error Log doesn't report any issue.
PHP Error Log doesn't report any issue.
HTTP Access Log reports:

"POST /oa/ajax/comment/reply/46/10 HTTP/1.1" 403 ... (redacted)

on every Reply a user tries.

What I notice - comparing replying to comments on OA 2.41 - is that a successful Reply to a Comment on OA 2.41 generates (as example):

"POST /oa/ajax/comment/376/reply/9 HTTP/1.1" 200 ... (redacted)

Look at the position of the Node, Reply and Comment Number which look inverted (reply/46/10 versus 376/reply/9). Maybe this is normal...I really don't know.

Posting Comments is OK: a successful posted Comment to the content type (e.g. Event in a Calendar Section or Post in a Discussion Section) generates these two lines on the HTTP Access Log:

"POST /comment/reply/46 HTTP/1.1" 302 ... (redacted)
"GET /helpdesk/management-calendar/test-event HTTP/1.1" 200 ... (redacted)

Does anybody experienced the same AJAX HTTP Error type on OA 2.43?

Thanks, Davide.