I built a little library to help solve this problem: https://github.com/krakenjs/fetch-robot

All requests are channelled through an iframe on the domain you want to make requests to; then the iframe publishes a policy for which requests are allowed to go through.