You almost had it.
In the $payload you need to set the default redirection param to 0/false, $payload['redirection'] = false;
The location header is empty because it followed through. Then you will be able to get the redirection URL from the Location header. You can see the list of arguments used here
Ok got it, knew there must be some built-in WP solution to this. Simply call wp_get_referer() in your callback (for details, see this).
At least it's working as I need it, let me know if there's any better solution.
Thanks to @Tom J Nowell, we should also mention that referrers could get stripped for privacy reasons or similar. To thus be on the safe ...
The problem is with the AJAX endpoint URL, i.e. url: userimg.ajax_url, which is not actually defined in your JS/PHP code.
More specifically, you did define the correct URL, but in the JS object, the property name is ajaxurl and not ajax_url:
// wrapped for brevity
wp_localize_script( 'ajax-account', 'userimg', array(
'ajaxurl' => admin_url( 'admin-ajax....