Woody does not restrict code in any way, including ajax requests.
The fact is that JavaScript is trying to find the getuser.php in the same folder, where js file is located.
Try specifying the path from the site root, for example:
xmlhttp.open("GET","/wp-content/getuser.php?q="+str,true);
Or...