I'm not saying this is a bad idea, but it is kind of opposed to the intention of CORS. This takes the decision about which pages are allowed to request a given resource away from the server writer and gives it back to everyone else.
Totally not ideal... but if you are looking to hack together a simple client side webapp that uses api's that do not support cors or jsonp you are not left with much of a choice without having a server side solution