Not all of our supported browsers support CORS; specifically, it's supported by:
Gecko 1.9.1 (Firefox 3.5, SeaMonkey 2.0) and above. (we support FIrefox 11+, thus we're fine)
WebKit (Initial revision uncertain, Safari 4 and above, Google Chrome 3 and above, possibly earlier) (we support chrome 18+ and safari 5.1+, thus fine)
MSHTML/Trident 4.0 (Internet Explorer 8) provides partial support via the XDomainRequest object. (we support 8+, so we... well, other than IE being silly we're fine)
Presto-based browsers (Opera) implement CORS as of Opera 12.00 and Opera Mobile 12, but not Opera Mini. (we support 10+ – i.e., at least two versions of opera we support don't support CORS)
(ref: wikipedia page on CORS)
http://chatlogs.musicbrainz.org/musicbrainz-devel/2013/2013-07/2013-07-08.html