I don't know if anybody else will ever have this same problem, but I was able to solve it. What I did was add "Access-Control-Allow-Origin" to the header of the response with the value "*". (I'll be changing the * to http://mydomain.com/ when we launch so I can keep the requests private.)