Creating this issue, because there seems to be some misunderstanding about the architecture of the above mentioned communication infrastructure.
The intended structure is that vis-widgets only communicate with the EEXCESS world via the web-messaging API, i.e. their embedding clients. This means, there are no ajax-calls from vis-widgets to the server components. On the other hand, the clients must implement the relevant events and handle the communication with the server components.
This issue serves for discussions, open questions and missing events that need to be added.