Getting Forbidden 403 from "POST" with https://trello.com/1/cards/{idCard}/actions/comments

[Joel]

Following codes are executed in a content script from a chome extension.
My intention is to add a card comment when the user clicks the Enter button in the Plus S/E Table.

var url = "https://trello.com/1/cards/" + idCard + "/actions/comments?text=" + encodeURIComponent(comment) + "&token=";
...
var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
...
sendExtensionMessage(
{ method: "queryTrelloToken" },
function (response) {
url = url + response.cookie_value;
xhr.open("POST", url);
xhr.send();
});

Here is the full content of url: 
https://trello.com/1/cards/JMX40Iwl/actions/comments?text=plus!%202.05%2F2.05%20Testing%20with%20S%2FE%20table%20entry&token=53e4a420f5f7adc461610c0c%2FATTSIx2HaOUy81FJhvRkck0A3ld0VGaSsmVlboyLEIbmvRWxI4rTfMMZiD8y0kjvrJNO94B76928

After executing xhr.send(), the console shows a 403 (forbidden) status.
What is the correct syntax to execute the add card comment action in the content script?
 

[Q xin]

https://www.mopay.site/