Google API error, but still works
This is a CORS issue Cross Origin Resource Sharing. You will need to add CORS on your server so that it sets correct headers. What is CORS and how to solve
Read up on: Wrong Origin using HTTPRequests
This is a bug
There seems to be a few workarounds there for people using it as part of an Apps Script Add-on, making reference to this stack question:
Though this doesn't work for the official quickstart using JavaScript.
I have tested this with Chrome and Firefox and both give the same results.
If this is affecting you please be sure to go and star the issue linked above.
While using Google APIs I find it easier setting up a virtual host and adding it to the OS hosts file. If you know how to set up self-signed certificates it can also be helpful.
Personally set up all my projects using Vagrant and Homestead with the SSL flag on. That way I can use the URL https://project.local/ and the browser doesn't complain as much about the X-Frame-Options
To enable SSL put ssl: true under the authorize: ~/.ssh/id_rsa.pub in the Homestead.yaml file that gets generated. By default the certificate won't be trusted so you will have to tell your OS that you want to trust it. I am afraid I don't remember how exactly I did that the last time.