Removing Allow-access-from-origin header as this header is helpful if deployed on the server that hosts the pdf not the one viewing it.

The only way to get around this is to host a proxy at app engine but that means using up bandwidth.

I think the way to go here is to host the pdfs on app engine site.