Snippet to test whether CORS works properly.

gistfile1.js

var xhr = new XMLHttpRequest();
xhr.open('GET', 'https://baas.kinvey.com/appdata/kidXXXX', true);
xhr.setRequestHeader('Authorization', 'Basic foo:bar');

// Enable the line below to provide Android support.
//xhr.setRequestHeader('X-Kinvey-Origin', 'http://www.example.com');

xhr.onload = function() {
  console.log("LOADED", this.status, this.responseText);
};
xhr.onerror = function() {
  console.log("ERROR", this.status, this.responseText);
};

xhr.send(null);