What if you try it like this instead of your localhost:
add name="Access-Control-Allow-Origin" value="domain"
Domain refers to your IIS server