I figured it out... Here's what was happening.

I was setting the expiration of certain file extensions to 30 days with:

location ~* ^.+.(jpg|jpeg|gif|css|png|js|ico)$ { access_log off; expires 30d; }

So, when the AJAX function was posting to upload/js, Nginx thought it was a static file, so Nginx threw a 405 Not Allowed. Why? Because I failed to escape the "." (any character) before js, so upload/js was the same as upload.js.

Correct regexp:

location ~* ^.+*\*.(jpg|jpeg|gif|css|png|js|ico)$ { access_log off; expires 30d; }