404 when navigating

Using IMCE with a plain <textarea>.

At first, nothing in the file browser worked. Made the following change to imce.module to get any functionality:

function imce_textarea($element) {
drupal_add_js(drupal_get_path('module', 'imce') .'/js/imce.js');
drupal_add_js(drupal_get_path('module', 'imce') .'/js/imce_set_app.js');
drupal_add_js(drupal_get_path('module', 'imce') .'/js/imce_extras.js');
drupal_add_css(drupal_get_path('module', 'imce') . '/css/imce-content.css');
drupal_add_js(drupal_get_path('module', 'imce') .'/js/imce_set_inline.js');
  static $ids;
...

Now the file browser shows. But click on a subdir, and a 404 error appears in the log.

This code in imce.js (line 642):

ajaxURL: function (op, dir) {
  var place = imce.conf.url + (imce.conf.clean ? '?' :'&') +'jsop='+ op +'&dir='+ (dir||imce.conf.dir);
  prompt('URL',place);
  return place;
},

produces:

/imce?jsop=navigate&dir=u3

in the prompt().

If I paste that into the address bar of the browser, get back something like:

{ "data": { "files": "\n\x3ctable id=\"file-list\" class=\"files\"\x3e\x3ctbody\x3e\x3c/tbody\x3e\x3c/table\x3e", "dirsize": "0 bytes", "subdirectories": [  ], "perm": { "subnav": 1, "browse": 1, "upload": 1, "thumb": 1, "delete": 1, "resize": 1, "mkdir": true, "rmdir": true } }, "messages": [  ] }

Added the full URL into imce.conf.url in the JS - same problem.