The error you are seeing occurs when you make a “cross-origin” request (a request from another domain other than .the domain your community is on). We block HTTP POST requests from other domains by default (a best practice for security – the browser blocks requests to different domains as part of the same-origin security policy), but a community can be configured to allow certain (or all) domains as part of our CORS support. You can file a support ticket with the domains you would like to alllow cross-domain requests from and support can configure your site to allow requests from those domains.
