Lock isn't removed automatically upon navigating away (AJAX callback fails with 403 forbidden)

Even with the option to "Use javascript to detect leaving the node form", lock is not removed upon navigating away. Have to click Save or Cancel explicitly. Furthermore, it fails silently to remove the lock.

I traced it back to a 403 Forbidden error using the Inpect Element + Network Monitor features in Firefox. The 403 code is the response of the AJAX callback that is supposed to remove the lock, for example :

http://mysite/ajax/content_lock/<nodeid>/canceledit?k=567816212&token=Y7onBnXopNIj4vO-4ZhmnmxRi9m6sVnLMlDoUD8osFY&_=1459778612610

I further traced this back to some issue with permissions/user access. As far as I know, the permissions were set correctly, with Authenticated users having the Check Out/Lock Documents permission.

Initial fix: I had to revert line 81 of content_lock.module

  78   $items['ajax/content_lock/%/canceledit'] = array(
  79     'page callback' => 'content_lock_release_own_item',
  80     'page arguments' => array(2, FALSE, FALSE),
  81     'access callback' => 'user_access',
  82   );

to:

  79   $items['ajax/content_lock/%/canceledit'] = array(
  78     'page callback' => 'content_lock_release_own_item',
  80     'page arguments' => array(2, FALSE, FALSE),
  81     'access callback' => TRUE,
  82   );

, which was the code used in 7.x-2.0 (at line 80 for that version).

Better fix: please see patch submitted in #9.

A temporary workaround for me was to unset "Use javascript to detect leaving the node form", but I would much rather keep this enabled.