Ok. I thought this only applied to POST php/cgi, but apparently it has to do with allowing anyone anywhere to have access to the script. I had to add this to the php script:

header('Access-Control-Allow-Origin: *');