I have same problem. Connections 5.5 CR2 and sametime 9.0.1.
Problem URL is like this:
https://serverurl/profiles/json/profile.do?email=person%40domain.com&lang=en&callback=stproxy.uiControl.connections.businesscard.onBusinessCard&dojo.preventCache=1486412564916
Browser debug: resource: the server responded with a status of 403 (Forbidden)
If I remove a part and send the URL like below it returns a json file with correct business card information:
https://serverurl/profiles/json/profile.do?email=person%40domain.com&lang=en&dojo.preventCache=1486412564916
I couldn't find information why the url part "callback=stproxy.uiControl.connections.businesscard.onBusinessCard" is a problem? What is the meaning of this url part?
Maybe a bug.
Thanks for any recommendation..