I've reopened the issue
I am working on the BOSH components for another issue (), so I will take a stab at this one as well.
Updated HttpBindServlet to return CORS headers for all HTTP responses (including errors) if CORS is active.
It seems that CORS headers are not set at all for 3.8.2 although I have enabled support for CORS in the admin panel:
Accept-Encoding gzip, deflate
User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0
Last-Modified Tue, 28 May 2013 14:42:50 GMT