CORS blocking query/records:bacth endpoint

CORS does not allow frame-of-reference header and query/records:bacth endpoint is blocked by CORS.