I still don't see the benefit to ACAO -- if you make a service public on the 'net, you need to protect it against malicious connection attempts. ACAO gives young developers (and they disproportionately gravitate towards the web) a false sense of security that setting the ACAO value correctly will "protect" them.

On the flip-side, stupid bugs for clients arise from different browsers having a different "strictness" on interpreting ACAO (for instance IE didn't enforce ACAO at all until years after Firefox started, so "Windows Shops (tm)" didn't fix their ACAO-busted sites for a while. Simple user pain.

On top of that, young developers that don't know about the ACAO headers may think cross-site AJAX is simply impossible and do crazy things like the proxy server thing you mentioned, just because they didn't know how to configure their original server correctly.

ACAO = all pain, no gain, and I hate that kind of nonsensical bullshit tech with a firey passion. :P