Since odoo/odoo@2afb5b43ef, fields should be whitelisted explictly.
Contains the new ajax post function introduced by e8d58dd in the community version of web that comes from mdo's original code and that I was not able to get rid of.
Christophe Simonis