Spyjax doesn't work in modern browsers anymore after all the major vendors plugged the hole. That's why people are resorting to the timing method instead.

This trick still works:

https://grepular.com/Abusing_HTTP_Status_Codes_to_Expose_Pri...

Although, the Google test on that particular page is currently not working.