Apparently OH does not return valid CORS headers for your client. Given that you use distinct ports web browser will complain.
Have a look on this: Cors problem - #2 by Fab4guy. There were some fixes also for authorization headers, however in your case it should not apply (since you rely on cookie which is set per domain name).
Best,
Łukasz