Sending AJAX to API triggers CORS which vCO seems to not support?

Hi,

I have a workflow which I want to run based on input provided by the user on a web page.  All well and good until I try to send the AJAX request as Chrome (and all modern browsers I believe) see that my web page is on one domain (selfservice.domain.com for example) and VCO is on another (vco.domain.com), and decides to initiate a preflight OPTIONS request which fails.

The way around this in general is to add the Access-Control-Allow-Origin header on the API webserver, but I've no idea how to do that in VCO or even if I should.

Has anyone run into this problem and worked around it?  We're using 5.5.2 by the way.

Thanks