It only allows bellard.org, not www.bellard.org. Changing the domain loads the same webpage, but with CORS working as intended.