Browser and AJAX response CORS headers differ
add_header only works with a new status codes (200, 204, 301, 302 or 304). The response missing the header is a 403, so add_header won't work. The third party headers more module is more flexible, and can add headers for any status code.