As of 2.8 it's changed slightly... So if you want to disable "secure forms" you'll need to use this in config.php instead of what is posted elsewhere.
$config['disable_csrf_protection'] = "y";
More info here: http://ellislab.com/blog/entry/sessions-login-modals-and-secure-forms-in-expressionengine-2.8
1.) Ensure your server time is set correctly and check your ExpressionEngine server timezone setting. Both the form hash ID and the session ID are time sensitive. If ExpressionEngine is calculating when to expire them based on an incorrect time, your hash ID may expire much sooner than it should.
2.) Quickest way to test whether it’s due to Secure Mode is to ...
Yes, you need to get a new XID each time via Ajax and update your form hidden value, so next time the form is submitted it uses the new XID.
Depends what your Ajax is returning of course and where it's submitting to, but in the past on return from the Ajax submission, I've fired another function to just do an Ajax request, then do the replacements.
I checked and I can see the XID param being sent to the jquery.ajax by looking in chrome network panel, i can see the query string it builds. So we are good there.
It sounds like you are sending the XID in GET instead of POST data. CSRF tokens must be present in the POST data if POST data is received by ExpressionEngine.
The following is true for any form generated by EE, including the Low Search form:
If you want the action url to be https, make sure the URL to the root directory of your site setting under Admin > General Configuration (aka the site_url config item) also starts with https.
Just thought I'd throw this in there for others that might find this post.
EE 2.8.1 removed the secure form option in the admin section of the CP. The only way to disable now is to add this to your config:
$config['disable_csrf_protection'] = 'y';
Just some FYI.
When I throw an ajax error I use ee()->security->restore_xid() so I can use the same token again. Per http://ellislab.com/expressionengine/user-guide/development/guidelines/security.html#cross-site-request-forgery