How does Access-Control-Allow-Origin header work? How does Access-Control-Allow-Origin header work? javascript javascript