I fixed it.

The key to the universe:
<allow-http-request-headers-from domain="*" headers="*"/>