Just as an aside for others using this feature, you need to check the OPTIONS request first and ensure that you reply with the correctly configured Access-Control-Allow-Origin and Access-Control-Allow-Headers headers for this to work.
Your browser will only send the actual GET or POST request if it gets the all clear fro the OPTIONS request first
The general gist of these posts suggest the problem of setting headers has been solved
but i Can't see how ? and the help file doesn't seem to explain how to use them.