CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Hello,

Using the legacy form and I’m having some trouble with CORS. I receive the following error message in the console: 

Access to XMLHttpRequest at 'https://manage.kmail-lists.com/subscriptions/subscribe' from origin 'https://mydomain.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Here’s my form tag: 

<form action="//manage.kmail-lists.com/subscriptions/subscribe" data-ajax-submit="//manage.kmail-lists.com/ajax/subscriptions/subscribe" method="GET" target="_blank" data-form-email="" novalidate="">

I’ve also added the necessary JavaScript file in my header (per the legacy form docs):

<script type="text/javascript" src="//www.klaviyo.com/media/js/public/klaviyo_subscribe.js"></script>

And have even added this to my .htaccess file: 

#Begin Klaviyo CORS
Header set Access-Control-Allow-Origin 'https://manage.kmail-lists.com'
Header set Access-Control-Allow-Source-Origin 'https://mydomain.com'
#End Klaviyo CORS

But, to no avail, it simply does not work as the post request is blocked. 

I’ve also double checked to ensure the headers module is in fact enabled in apache. 

Anything I’m doing wrong?