Looks like they're using CORS. The Access-Control-* response headers control that.